Endpoint Detection & Response (EDR) by LimaCharlie provides true real-time endpoint detection and response capabilities. It streams telemetry from the endpoint sensor to the cloud in real-time over a semi-persistent TLS connection. Response actions are taken on the endpoint within 100 milliseconds of the triggering action or behavior. LimaCharlie’s EDR allows for the creation of advanced detection logic using a YAML-based detection syntax, which includes tracking, state, and multi-step detection logic that runs at wire speed. It supports running custom scripts, downloading files, and replacing much of the functionality of existing remote monitoring and management (RMM) tools. The EDR platform is designed to be flexible, powerful, and cost-effective, with the ability to transition from or augment existing EDR solutions. It offers full API access for automation and custom solution creation, and it supports feature parity across all major operating systems. The platform also enables the execution of a full suite of remediation responses, such as triggering memory dumps or killing a process tree, and supports continuous YARA rule scanning across the fleet.
