LimaCharlie normalizers

Bundle limacharlie edr

Every LimaCharlie normalizer, covering EDR process, network, activity and injection events, detections, and Sysmon over WEL.

Add it

In Bifract, open Exchange, find LimaCharlie normalizers and click Add. Adds each of its items that is not there yet, requirements first.

Contents

Kind	Item	What it is
Normalizer	LimaCharlie EDR - Process	Maps LimaCharlie NEW_PROCESS and EXISTING_PROCESS events.
Normalizer	LimaCharlie EDR - Network	Maps LimaCharlie NETWORK_CONNECTIONS, NEW_TCP4_CONNECTION and CODE_IDENTITY events.
Normalizer	LimaCharlie EDR - Activity	Maps LimaCharlie NEW_DOCUMENT, DNS_REQUEST and TERMINATE_PROCESS events.
Normalizer	LimaCharlie EDR - Injection	Maps LimaCharlie REMOTE_PROCESS_HANDLE and NEW_REMOTE_THREAD events.
Normalizer	LimaCharlie - Detections	Maps LimaCharlie D&R detections (output --type detect).
Normalizer	LimaCharlie WEL - Sysmon	Maps Sysmon events delivered through LimaCharlie's Windows Event Log stream.