September 6th, 2024
Developer Roll Up: August 2024
Christopher Luft
Another month in the books, and another round of enhancements to the SecOps Cloud Platform. Here’s what’s new and coming soon with LimaCharlie:
Upcoming Events
Webinar: Hunting with the LimaCharlie Query Console When: Sep 10
Join us as we explore LimaCharlie’s Query Console, and learn how you can structure queries to quickly hunt through any historical data set, find value, and uncover hidden gems.
MSSN CTRL When: Oct 2-4
Join us at MSSN CTRL, a three-day interactive security event in Arlington, VA.
Gain hands-on experience with the latest security techniques through in-depth technical training and workshops, including exclusive LimaCharlie training.
Secure your spot and check out the speaker lineup
MSSP Alert Live When: Oct 14-16
Join us at this year's MSSP Alert Live event and visit the LimaCharlie booth to meet the team behind the SecOps Cloud Platform. Don’t miss the chance to pick up some swag and enter our exciting giveaway!
Defender Fridays When: Every Friday @ 10:30am PT
Participate in our weekly Defender Fridays series where we explore the defensive side of cybersecurity with seasoned professionals from across the industry.
—
August’s Releases
Sensor 4.30.0
New events for macOS
USER_LOGIN, USER_LOGOUT
SSH_LOGIN, SSH_LOGOUT
Remember that given those are new events, you will have to enable them in the Event Collection section of your orgs.
LCQC now offers free 30-day querying, plus the ability to save queries.
We are excited to announce that querying the last 30 days in the LimaCharlie query console is now free. For instance,
If the time range your query applies to is July 30, 2024 to August 21, 2024, the query will be free as it is within the past 30 days.
If the time range your query applies to is July 15, 2024 to August 21, 2024, you will only be billed for 7 days (the past 30 days are free).
In addition, we have added the ability for users to save LCQC queries. Once saved, queries can be used across their entire Organization.
To save, view, or edit saved queries, users will need to be granted appropriate permissions:
query.del - Delete saved queries
Query.get - Get saved queries
query.get.mtd - Get saved queries metadata
query.set - Set saved queries
query.set.mtd - Set saved queries metadata
Infrastructure-as-Code (IaC) templates
The LimaCharlie Infrastructure-as-Code (IaC) Generator allows users to select various configurations and automatically generate YAML templates for LimaCharlie deployments. The interface includes several tabs for different configuration categories, each allowing users to select specific options. The YAML is generated live as options are toggled in the UI.
For more information on how to apply IaC configurations to an LC org, read about the infrastructure extension here.