LimaCharlie

https://docs.limacharlie.io
Admin
LimaCharlie is an agentic SecOps workspace providing comprehensive enterprise security operations...
Tokens:2,199,382
Snippets:13,362
Trust Score:9.2
Update:1 week ago
Show doc for...
Tokens:
Raw
### Generate onboarding guide for Google Workspace or Microsoft 365

Source: https://docs.limacharlie.io/email-security/setup-cli

Run the CLI to get a headless onboarding guide for the specified provider. Replace $OID with your organization ID. The guide includes setup steps, OAuth scopes, and gcloud commands.

```bash
limacharlie mailsec onboarding --provider gworkspace --oid $OID
limacharlie mailsec onboarding --provider m365 --oid $OID

```

--------------------------------

### GET /onboarding

Source: https://docs.limacharlie.io/email-security/api-reference?q=

Retrieves setup steps, OAuth scopes, and gcloud commands for connecting a tenant.

```APIDOC
## GET /onboarding

### Description
Retrieves setup steps, OAuth scopes, and gcloud commands for connecting a tenant.

### Method
GET

### Endpoint
/onboarding

### Parameters
#### Query Parameters
- **provider** (string) - Optional - Provider type: `gworkspace` (default) or `m365`.
- **project_id** (string) - Optional - Google Cloud project ID.
- **sa_email** (string) - Optional - Service account email.
- **topic** (string) - Optional - Pub/Sub topic.
- **subscription** (string) - Optional - Pub/Sub subscription.

### Response
#### Success Response (200)
- **scopes** (array) - OAuth scopes.
- **steps** (array) - Setup steps, each with `console` and optionally `verified_by`.
- **script** (string) - gcloud commands.

#### Response Example
{
  "scopes": [],
  "steps": [],
  "script": "string"
}
```

--------------------------------

### Get List of Users Example

Source: https://docs.limacharlie.io/5-integrations/extensions/cloud-cli/okta

Example input and output for listing users.

```text
user list
```

```json
[
  {
    "_links": {
      "self": {
        "href": "https://dev-8675309.okta.com/api/v1/users/00un2JpnNwheWSzOe5d7"
      }
    },
    "created": "2025-01-31T12:26:30Z",
    "credentials": {
      "password": {},
      "provider": {
        "name": "OKTA",
        "type": "OKTA"
      }
    },
    "id": "00up0nl0lftw7331WSz",
    "lastLogin": "2025-03-14T13:36:13Z",
    "lastUpdated": "2025-02-10T15:33:00Z",
    "passwordChanged": "2025-02-10T15:33:00Z",
    "profile": {
      "email": "fake.user@limacharlie.com",
      "firstName": "Fake",
      "lastName": "User",
      "login": "fake.user@limacharlie.com",
      "mobilePhone": null,
      "secondEmail": null
    },
    "status": "ACTIVE",
    "statusChanged": "2025-02-10T15:33:00Z",
    "type": {
      "id": "otyn2jpriwmLdgaiL5d7"
    }
  }
]
```

--------------------------------

### GET /onboarding

Source: https://docs.limacharlie.io/email-security/api-reference

Retrieves the setup steps, OAuth scopes, and gcloud commands for connecting a tenant. Parameters can be supplied to get ready-to-run commands.

```APIDOC
## GET /onboarding

### Description
Retrieves the setup steps, OAuth scopes, and gcloud commands for connecting a tenant. Parameters can be supplied to get ready-to-run commands.

### Method
GET

### Endpoint
/onboarding

### Parameters
#### Query Parameters
- **provider** (string) - Optional - Provider: `gworkspace` (default) or `m365`.
- **project_id** (string) - Optional - Google Cloud project ID.
- **sa_email** (string) - Optional - Service account email.
- **topic** (string) - Optional - Pub/Sub topic.
- **subscription** (string) - Optional - Pub/Sub subscription.

### Response
#### Success Response (200)
- **scopes** (array) - OAuth scopes.
- **steps** (array) - Setup steps, each with a `console` and optionally a `verified_by`.
- **script** (string) - The gcloud commands.

#### Response Example
{
  "scopes": [],
  "steps": [],
  "script": "string"
}

### Authentication
No specific permission mentioned.
```

--------------------------------

### Add Installation Key

Source: https://docs.limacharlie.io/6-developer-guide/sdks/go-sdk

Creates a new installation key with optional custom ID. The example shows setting a description, tags, and UsePublicCA flag.

```go
key := limacharlie.InstallationKey{
    Description: "Production Servers",
    Tags:        []string{"production", "linux"},
    UsePublicCA: false, // Use LimaCharlie's certificate
}

iid, err := org.AddInstallationKey(key)
if err != nil {
    log.Fatal(err)
}
fmt.Printf("Created installation key: %s\n", iid)

// With custom ID
key.ID = "custom-key-id"
iid, err = org.AddInstallationKey(key)

```

--------------------------------

### Install Main SDK Package

Source: https://docs.limacharlie.io/6-developer-guide/sdks/go-sdk

Installs the main LimaCharlie Go SDK package using go get.

```bash
go get github.com/refractionPOINT/go-limacharlie/limacharlie

```

--------------------------------

### Install Go SDK

Source: https://docs.limacharlie.io/6-developer-guide/extensions/building-extensions?q=

Installs the Go SDK for LimaCharlie extensions using go get. The Go SDK is the more complete of the two and is used in the examples on this page.

```bash
go get github.com/refractionPOINT/lc-extension

```

--------------------------------

### Run the init.d sample install script

Source: https://docs.limacharlie.io/2-sensors-deployment/endpoint-agent/linux/installation?q=

Makes the sample install script executable and runs it with the path to the sensor and the installation key. The script is a common methodology for Linux using init.d.

```bash
sudo chmod +x ./lc_linux_installer.sh
sudo ./lc_linux_installer.sh <PATH_TO_LC_SENSOR> <YOUR_INSTALLATION_KEY>

```

--------------------------------

### Get dashboard counts via CLI

Source: https://docs.limacharlie.io/5-integrations/extensions/limacharlie/cases

Use this LimaCharlie CLI command to retrieve the same dashboard counts as the REST API example. Requires the limacharlie CLI to be installed and configured.

```bash
limacharlie case dashboard
```

--------------------------------

### Get User Details - Example Input

Source: https://docs.limacharlie.io/5-integrations/extensions/cloud-cli/okta?q=

Example input for the 'user get' command using a sample User ID.

```bash
user get 00untroxqpl08VcNC5d7
```

--------------------------------

### Run headless onboarding guide for Google Workspace or Microsoft 365

Source: https://docs.limacharlie.io/email-security/setup-cli?q=

Use these commands to display the onboarding guide without a browser. Replace $OID with your organization ID.

```bash
limacharlie mailsec onboarding --provider gworkspace --oid $OID
limacharlie mailsec onboarding --provider m365 --oid $OID
```

--------------------------------

### Get User Details - Example Output

Source: https://docs.limacharlie.io/5-integrations/extensions/cloud-cli/okta?q=

Example JSON output from the 'user get' command, showing user details including profile, status, and links.

```json
{
  "_links": {
    "deactivate": {
      "href": "https://dev-8675309.okta.com/api/v1/users/00up0nl0lftw7331WSz/lifecycle/deactivate",
      "method": "POST"
    },
    "schema": {
      "href": "https://dev-8675309.okta.com/api/v1/meta/schemas/user/otyn3jlrawrlmageyL2d7"
    },
    "self": {
      "href": "https://dev-8675309.okta.com/api/v1/users/00up0nl0lftw7331WSz"
    },
    "type": {
      "href": "https://dev-8675309.okta.com/api/v1/meta/types/user/otyn3jlrawrlmageyL2d7"
    },
    "unsuspend": {
      "href": "https://dev-8675309.okta.com/api/v1/users/00up0nl0lftw7331WSz/lifecycle/unsuspend",
      "method": "POST"
    }
  },
  "activated": "2025-03-13T17:37:33Z",
  "created": "2025-03-13T17:37:33Z",
  "credentials": {
    "password": {},
    "provider": {
      "name": "OKTA",
      "type": "OKTA"
    }
  },
  "id": "00up0nl0lftw7331WSz",
  "lastUpdated": "2025-03-14T13:37:10Z",
  "passwordChanged": "2025-03-13T17:37:33Z",
  "profile": {
    "email": "fake.user@limacharlie.com",
    "firstName": "Fake",
    "lastName": "User",
    "login": "fake.user@limacharlie.com",
    "mobilePhone": null,
    "secondEmail": null
  },
  "status": "ACTIVE",
  "statusChanged": "2025-03-14T13:37:10Z",
  "type": {
    "id": "otyn3jlrwwlmageyL2d7"
  }
}
```

--------------------------------

### Run adapter with inline parameters

Source: https://docs.limacharlie.io/2-sensors-deployment/adapters/usage?q=

Use this command to start an adapter with all required client_options passed as inline parameters. Replace placeholders like <INSTALLATION KEY>, <ORG ID>, <SENSOR SEED KEY>, and <EVENT TYPE FIELD> with actual values.

```bash
./lc-adapter file file_path=/path/to/logs.json \
  client_options.identity.installation_key=<INSTALLATION KEY> \
  client_options.identity.oid=<ORG ID> \
  client_options.platform=json \
  client_options.sensor_seed_key=<SENSOR SEED KEY> \
  client_options.mapping.event_type_path=<EVENT TYPE FIELD> \
  client_options.hostname=<HOSTNAME>
```

--------------------------------

### Create an Installation Key - Go SDK

Source: https://docs.limacharlie.io/2-sensors-deployment/installation-keys

Creates an installation key using the Go SDK. Requires an API key with ikey.set permission. Replace YOUR_OID and YOUR_API_KEY with your credentials. The AddInstallationKey method takes an InstallationKey struct with Description and Tags.

```go
import limacharlie "github.com/refractionPOINT/go-limacharlie/limacharlie"

client, _ := limacharlie.NewClient(limacharlie.ClientOptions{
    OID:    "YOUR_OID",
    APIKey: "YOUR_API_KEY",
}, nil)
org, _ := limacharlie.NewOrganization(client)

iid, err := org.AddInstallationKey(limacharlie.InstallationKey{
    Description: "Production servers",
    Tags:        []string{"server", "prod"},
})
```

--------------------------------

### Scoped Bash patterns: Bash(git:*), Bash(npm install:*), Bash(kubectl get:*)

Source: https://docs.limacharlie.io/9-ai-sessions/tool-permissions

Shows the accepted scoped Bash pattern syntax. Only the prefix:* form is recognized. Each pattern matches any command that starts with the given prefix followed by a space.

```bash
Bash(git:*)            # any command starting with "git "
Bash(npm install:*)    # any command starting with "npm install "
Bash(kubectl get:*)    # read-only kubectl verbs

```

--------------------------------

### Create an Installation Key - CLI

Source: https://docs.limacharlie.io/2-sensors-deployment/installation-keys

Creates an installation key using the CLI. Requires an API key with ikey.set permission. The --description and --tags flags are required.

```bash
limacharlie installation-key create --description "Production servers" --tags "server,prod"
```

--------------------------------

### Get Specific Installation Key

Source: https://docs.limacharlie.io/6-developer-guide/sdks/go-sdk

Retrieves a single installation key by its ID.

```APIDOC
## Get Specific Installation Key

### Description
Retrieves a single installation key by its ID.

### Method
SDK Method

### Endpoint
`org.InstallationKey("installation-key-id")`

### Parameters
- **installation-key-id** (string) - Required - The ID of the installation key to retrieve.

### Request Example
```go
key, err := org.InstallationKey("installation-key-id")
if err != nil {
    log.Fatal(err)
}
fmt.Printf("Key: %s\n", key.Key)
fmt.Printf("JSON Key: %s\n", key.JsonKey)
```

### Response
Returns an installation key object with fields: Key, JsonKey.
```

--------------------------------

### POST /v1/installationkeys/{oid}

Source: https://docs.limacharlie.io/2-sensors-deployment/installation-keys

Creates a new installation key with a description and optional tags. Requires an API key with ikey.set permission.

```APIDOC
## POST /v1/installationkeys/{oid}

### Description
Creates a new installation key with a description and optional tags.

### Method
POST

### Endpoint
https://api.limacharlie.io/v1/installationkeys/{oid}

### Parameters
#### Path Parameters
- **oid** (string) - Required - The organization ID.

#### Request Body
- **desc** (string) - Required - Description of the installation key.
- **tags** (string) - Optional - Comma-separated list of tags.

### Request Example
```
curl -s -X POST "https://api.limacharlie.io/v1/installationkeys/YOUR_OID" \
  -H "Authorization: Bearer $LC_JWT" \
  -d "desc=Production+servers&tags=server,prod"
```

### Response
#### Success Response (200)
- **iid** (string) - The ID of the created installation key.

#### Response Example
(No explicit response example provided in source.)
```

--------------------------------

### Run adapter with configuration file

Source: https://docs.limacharlie.io/2-sensors-deployment/adapters/usage

Shows how to launch an adapter using a YAML configuration file. The example uses the 'file' adapter and passes the configuration file path as an argument.

```bash
./lc-adapter file config_file.yaml

```

--------------------------------

### Confirm CLI installation

Source: https://docs.limacharlie.io/6-developer-guide/cli-quickstart?q=

Confirm the CLI installation. The output should start with 'limacharlie, version' followed by the installed version number.

```bash
limacharlie --version
```

--------------------------------

### Silent MSI installation with specific MSI path

Source: https://docs.limacharlie.io/2-sensors-deployment/endpoint-agent/windows/installation?q=

Example of a silent MSI installation using a specific installer path (C:\Downloads\hcp_win_x64.msi) and the installation key.

```cmd
msiexec /i "C:\Downloads\hcp_win_x64.msi" /qn INSTALLATIONKEY="YOUR_INSTALLATION_KEY_GOES_HERE"

```

--------------------------------

### Get ARL example

Source: https://docs.limacharlie.io/6-developer-guide/sdks/python-sdk-v4

Example of using get-arl to retrieve data from a specific ARL.

```bash
limacharlie get-arl -a [github,Yara-Rules/rules/email]

```

--------------------------------

### List Installation Keys - Go SDK

Source: https://docs.limacharlie.io/2-sensors-deployment/installation-keys

Lists installation keys using the Go SDK. Requires an API key with ikey.list permission. Replace YOUR_OID and YOUR_API_KEY with your credentials.

```go
import limacharlie "github.com/refractionPOINT/go-limacharlie/limacharlie"

client, _ := limacharlie.NewClient(limacharlie.ClientOptions{
    OID:    "YOUR_OID",
    APIKey: "YOUR_API_KEY",
}, nil)
org, _ := limacharlie.NewOrganization(client)

keys, err := org.InstallationKeys()
```

--------------------------------

### Install from source

Source: https://docs.limacharlie.io/6-developer-guide/sdks/python-sdk

Clones the repository and installs the SDK in development mode with dev dependencies.

```bash
git clone https://github.com/refractionPOINT/python-limacharlie.git
cd python-limacharlie
pip install -e ".[dev]"

```

--------------------------------

### Get User Details Example

Source: https://docs.limacharlie.io/5-integrations/extensions/cloud-cli/okta

Example input and output for fetching user details.

```text
user get 00untroxqpl08VcNC5d7
```

```json
{
  "_links": {
    "deactivate": {
      "href": "https://dev-8675309.okta.com/api/v1/users/00up0nl0lftw7331WSz/lifecycle/deactivate",
      "method": "POST"
    },
    "schema": {
      "href": "https://dev-8675309.okta.com/api/v1/meta/schemas/user/otyn3jlrawrlmageyL2d7"
    },
    "self": {
      "href": "https://dev-8675309.okta.com/api/v1/users/00up0nl0lftw7331WSz"
    },
    "type": {
      "href": "https://dev-8675309.okta.com/api/v1/meta/types/user/otyn3jlrawrlmageyL2d7"
    },
    "unsuspend": {
      "href": "https://dev-8675309.okta.com/api/v1/users/00up0nl0lftw7331WSz/lifecycle/unsuspend",
      "method": "POST"
    }
  },
  "activated": "2025-03-13T17:37:33Z",
  "created": "2025-03-13T17:37:33Z",
  "credentials": {
    "password": {},
    "provider": {
      "name": "OKTA",
      "type": "OKTA"
    }
  },
  "id": "00up0nl0lftw7331WSz",
  "lastUpdated": "2025-03-14T13:37:10Z",
  "passwordChanged": "2025-03-13T17:37:33Z",
  "profile": {
    "email": "fake.user@limacharlie.com",
    "firstName": "Fake",
    "lastName": "User",
    "login": "fake.user@limacharlie.com",
    "mobilePhone": null,
    "secondEmail": null
  },
  "status": "ACTIVE",
  "statusChanged": "2025-03-14T13:37:10Z",
  "type": {
    "id": "otyn3jlrwwlmageyL2d7"
  }
}
```

--------------------------------

### Generate onboarding guide with pre-filled Google project details

Source: https://docs.limacharlie.io/email-security/setup-cli

Use this command to fill the Google commands in advance with your project details. Set the variables GCP_PROJECT and SERVICE_ACCOUNT_EMAIL to your project and service account email from the downloaded key.

```bash
limacharlie mailsec onboarding --provider gworkspace \
  --project-id "$GCP_PROJECT" --sa-email "$SERVICE_ACCOUNT_EMAIL" \
  --topic mailsec-gmail-push --subscription mailsec-gmail-push-sub \
  --oid "$OID" --output yaml

```

--------------------------------

### Install Firehose CLI Tool

Source: https://docs.limacharlie.io/6-developer-guide/sdks/go-sdk

Installs the Firehose CLI tool package using go get.

```bash
go get github.com/refractionPOINT/go-limacharlie/firehose

```

--------------------------------

### Get GitHub installation ID with gh CLI

Source: https://docs.limacharlie.io/cloud-security/provider-setup/github

Use this command as an org owner to list installations and extract the installation ID and app slug. The installation ID is also visible in the browser URL of the installation settings page.

```bash
gh api /orgs/<org>/installations --jq '.installations[] | {id, app_slug}'

```
Tokens:
Raw