SOC Prime’s Detection as Code platform, the world’s largest and most advanced platform for collaborative cyber defense, integrates with 25+ SIEM, EDR, and XDR formats and continuously broadens the support for cloud-based cybersecurity solutions. We are thrilled to announce SOC Prime’s integration with LimaCharlie enabling security professionals to obtain the most relevant detection content tailored to this cloud-first EDR/XDR solution.
LimaCharlie operates a leading Information Security Infrastructure as a Service (SIaaS) platform providing real-time Endpoint Detection and Response (EDR) and Extended Detection and Response (XDR) capabilities aligned with unique, organization-specific security procedures. LimaCharlie takes a scalable vendor-neutral approach to the delivery of security infrastructure services providing integration and support for a variety of security tools leveraged by teams. By expanding integration with LimaCharlie EDR/XDR, we’re enriching the translation capabilities of SOC Prime’s Detection as Code platform with more cloud-based language formats and serving the needs of a wider audience of our global cybersecurity community.
Backed by the collaborative expertise of the global cybersecurity community, SOC Prime’s platform currently curates 3,000+ Sigma behavior-based detections converted to the LimaCharlie Rule format. The SOC content base is exponentially growing and continuously updated to cover the latest threats and ensure proactive cyber defense. Detection content alignment with the MITRE ATT&CK® framework enables SOC Prime users to reach the most relevant rules matching the organization’s threat profile.
Obtaining LimaCharlie Rule Code in a Single Click
To browse the SOC Prime’s platform for the most relevant detection algorithms, choose the Discover category after logging in and then drill down to the Advanced Search page. To instantly search for detections tailored to this EDR/XDR format, filter content by the LimaCharlie platform. Applying the Lucene query syntax can help narrow the search to specific tags, log sources, CVE, exploits, and other custom filter conditions.
For better content categorization, Sigma rules and their cross-tool translations are now available as Alerts and Queries depending on their intended purpose of use. Security practitioners can apply Content Type filtering by Alerts, which are better suited for triggering notifications and are less likely to generate false positives, or Queries, which are a perfect fit for hunting and threat investigation.
Once filtered, teams can drill down to the content item page to dive into linked cyber threat intelligence, view the operational metadata, like the rule status and severity, or explore CVE and MITRE ATT&CK references for more context. To reach the detection logic, choose the Code tab, and the LimaCharlie Rule tab will be selected at once displaying the content already converted to the corresponding EDR/XDR format. For now, SOC Prime’s platform allows grabbing the source code with a single click using the Copy to Clipboard button and then pasting it to your environment on the fly.
Custom Field Mapping Support
SOC Prime delivers a Custom Field Mapping solution for deployments based on the custom data that cannot be automatically mapped to the default data schema recommended by the cybersecurity vendor. LimaCharlie customers can apply a pre-configured Custom Field Mapping profile to seamlessly deploy LimaCharlie Rules tailored to the specific environment needs that go beyond vendor specifications. To enable custom deployments, SOC Prime users need to specify non-standard fields that will be mapped according to the custom data schema. Custom Field Mapping profiles can also be shared across the company, so anyone on your team can apply these pre-configured settings before content deployment.
Continuous Streaming of Detection Content from Static and Dynamic Content Lists Directly into Your LimaCharlie Instance
Leveraging the SOC Prime Continuous Content Management (CCM) API, security engineers can stream detection logic directly into their LimaCharlie EDR/XDR environment. Using particular API queries and endpoints, teams can create Content Lists tailored to their security needs and automatically pull the most up-to-date detections from these lists. Detection algorithms can also be automatically optimized for operations by applying non-standard data schemas for scalable deployments and custom environment needs.
To take advantage of the automated content streaming capabilities, make sure the API access is enabled. For more details on how to set up relevant configurations and get started, download the guide for the latest version of the CCM API Integration Tool.
For more streamlined and intuitive content deployment, SOC Prime users can also take advantage of the FREE socprime add-on from LimaCharlie’s marketplace. SOC Prime users can leverage this add-on to choose pre-configured Content Lists to sync and enable them as D&R (detection and response) rules used to automate actions based on the real-time events in LimaCharlie.
First, security practitioners need to configure specific Content Lists via the SOC Prime’s CCM module so they can further pull detections from these lists to their LimaCharlie instance using the socprime add-on.
LimaCharlie users can leverage the following capabilities of Content Lists:
- Manually add content items to statiс lists.
- Create dynamic lists to continuously deliver the most recent and updated detection algorithms matching pre-configured custom filters.
Adding Hand-Picked Content to Static Lists
Security practitioners can add selected LimaCharlie Rules to the specific static Content List right from the rule page.
- First, log into your SOC Prime account.
- Drill down to the Code tab of the selected rule page.
- Make sure that the LimaCharlie Rule format is displayed. SOC Prime users will automatically see this language format if the LimaCharlie EDR/XDR has been selected in the Account settings or after applying the corresponding platform filter.
- Click Add to CCM List in the upper right-hand corner of the Code tab.
5. Select a specific Content List and click Done. You can also add the same content item to multiple Content Lists at once.
6. If you cannot find the Content List that matches your needs, click the Create New Content List button to build a new one from scratch.
Once added, the selected LimaCharlie Rule will be instantly added to the hand-picked Static list on the Content Lists page. If you no longer need the added content item, click Delete and confirm the action.
Setting Up Automatically Populated Dynamic Lists
Apart from adding detection content manually to static Content Lists, SOC Prime users can create dynamic lists to automatically stream LimaCharlie Rules matching the pre-configured filter conditions.
- On the Content Lists page, click the Create button.
- Fill in the list name and select the Dynamic option from the Type drop-down list.
- If needed, fill in optional customization settings, like list description, category, as well as include or exclude tags.
- To set the list to the LimaCharlie Rule format, click Advanced Filters, then find Content Platform, and select LimaCharlie from the list of options.
- Optionally, apply more filters, like the MITRE ATT&CK® technique, rule severity, Sigma status, or the date of rule creation to enable streaming of the most relevant detection content directly into your environment.
- Click the Save Changes button to finish creating a new dynamic list you can then sync with the socprime add-on.
Please note that dynamic lists have a content limit of 500 most recently released items to prevent your platform overload.
Therefore, make sure to customize dynamic lists based on a number of conditions matching your organization’s threat profile and environment to enable your LimaCharlie EDR/XDR to find the most relevant threats.
After setting up Content Lists in the SOC Prime’s platform, log into your LimaCharlie account to finish the configuration between two platforms and enable content streaming.
Go to the socprime add-on page to explore brief guidelines on how to enable CCM configuration in LimaCharlie via the Integrations page. For more, details on how to set up add-on configurations in the LimaCharlie environment, read our partner blog post.
On-the-Fly Conversions to the LimaCharlie Rule Format via Uncoder.IO
SOC Prime enables on-the-fly content conversions to various SIEM, EDR, and XDR formats using the online Sigma rule translation engine, Uncoder.IO. The use of Uncoder.IO is fully anonymous and ensures data privacy protection for customers. No logs are collected when using the translation engine and no user registration or authentication are required.
With Uncoder.IO, security engineers can easily convert Sigma-based detections to the LimaCharlie Rule format from a single place. To get an instant content translation, insert the Sigma code into the left panel, select the LimaCharlie platform from the list of supported language formats on the right panel, and then click Translate. In a matter of seconds, Uncoder.IO will provide a result with the generated rule that is ready to run in the customer’s environment.
To keep your SIEM or EDR updated with the latest detection and response algorithms, join SOC Prime’s platform and make one step toward easier, faster, and more efficient cyber defense. Eager to join SOC Prime’s crowdsourcing initiative? Explore the SOC Prime Threat Bounty Program enabling researchers to monetize their own detection content while contributing to a safer future.
