performance-optimizer

To reduce LimaCharlie billing costs without losing security coverage, apply performance tuning techniques like sensor culling with TTLs, detections-forwarding only, and GCP in-region outputs to minimize data egress and SIEM load.

Sensor culling optimizes deployment quotas by automatically removing inactive sensors using configured TTLs, which reduces quota waste and simplifies fleet management without impacting active security coverage.

Setting up GCP in-region outputs cuts data egress fees by keeping archived data within the same Google Cloud Platform region, eliminating most outbound transfer costs associated with external SIEM forwarding.

Yes, you can forward only detections to your SIEM instead of full telemetry to dramatically cut data egress volume and SIEM ingestion load while still maintaining core detection and alerting capabilities.

The best way to optimize LimaCharlie queries and reduce compute noise is applying suppression rules to filter redundant alerts, which lowers query volume and streamlines overall detection processing.

Performance tuning affects existing LimaCharlie extensions and outputs by restructuring them for efficiency, such as switching output streams to detections only and enabling usage alerts to monitor extension billing quotas.