Hot Topics
Security Bloggers Network 
SBN

June Developer Roll Up

Avatar photo by LimaCharlie's Blog on June 30, 2021

Our development roll up this month includes one of the most exciting innovations LimaCharlie has made to date. Along with our predictable per endpoint pricing model, we are now offering a pure usage-based billing model for our Endpoint Detection & Response (EDR) capability. Along with this industry first we have also made some changes to the API, refactored the Add-ons Marketplace experience 

Usage-Based Billing

LimaCharlie is doing something that has never been done before in cybersecurity. Along with our predictable per endpoint pricing model, we are now offering a pure usage-based billing model for our Endpoint Detection & Response (EDR) capability. Pricing under this model is calculated solely on the time the sensor is connected, events processed and events stored.

  1. Incident responders will now be able to offer pre-deployments to their customers at almost zero cost. That is, they can deploy across an organization's entire fleet and lay dormant in ‘sleeper mode’ at a cost of just US$0.02 per month. With agents deployed ahead of an incident, responders can offer SLA’s that their competition can’t even dream about. Respond with the full power of the platform in minutes of an incident occurring.

  2. Product developers can take advantage of usage-based billing to leverage narrow bands of functionality at a low cost. This means you can get the functionality you need without building it from the ground up or paying for a full EDR deployment: keep more of your margins. Nobody else is even thinking about this, and we are so excited to see what people build.

Usage-based billing is currently only available for new organizations and on a limited basis. Please contact us at [email protected] for more information and to get a new organization set up for usage-based billing.

VirusTotal API

We've updated the lcr://api/vt API that can be used in D&R rules to support Domains and IPs on top of the existing Hashes support.

Usage is exactly as before, the value provided in the lookup will automatically be detected to be a Domain, IP or Hash.

Here is an example of a rule leveraging VirusTotal for Domains:

New Add-ons Marketplace

We've done a redesign of our add-on browsing / management experience. 

Some highlights:

  • Add-ons now live in a marketplace which you can browse anytime, specifying which org(s) you want to subscribe to add-ons

  • Add-ons are now searchable, both from the marketplace and within orgs

  • Add-on authors now get separate preview descriptions & full markdown descriptions to better promote their add-ons

  • We've done a content audit to make sure our published add-ons are as descriptive as possible so everyone can set them up and use them

  • The Add-ons view within orgs is now a focused list of add-ons that are currently enabled in that org

  • Detection add-ons are now marked for deprecation, meaning we don't show them in the new marketplace. We feel that managed rule sets via Service add-ons are a better experience overall since you can simply enable them with no extra steps

For those already familiar with Add-on system in LimaCharlie you can see a tour of the update here.

For those unfamiliar with the LimaCharlie Add-on Marketplace, a full walkthrough with implementation examples can be found here.

Sensor v4.25.1

  • Enhanced hashing on Windows.

  • More reliable process parent/child tracking under load.

SHARE

*** This is a Security Bloggers Network syndicated blog from LimaCharlie's Blog authored by LimaCharlie's Blog. Read the original post at: https://www.limacharlie.io/blog/2021-june-developer-roll-up

LimaCharlie's Blog