sensor-tasking

Live response tasking sends commands directly to online EDR sensors to gather data or execute actions. Use the Task tool with the limacharlie-api-executor subagent to deploy tasks across your sensor fleet, collecting responses inline or via LCQL queries for forensic investigation and fleet-wide operations.

Reliable tasking enables offline agent tasking with TTL (time-to-live) settings. Tasks queue on offline sensors and execute when they reconnect, making reliable tasking essential for large deployments and intermittently online hosts where direct tasking alone is insufficient.

Create D&R (Detect & Respond) rules to automate response handling after tasking completes. Rules trigger on collected responses, enabling fleet-wide automated actions like host isolation, policy enforcement, or alert generation without manual intervention.

LCQL queries consolidate responses across sensors into unified datasets. Query collected task results to extract OS versions, process lists, file inventories, or other telemetry across your fleet, then aggregate and analyze the consolidated output for threat hunting or compliance.

Sensor-tasking supports targeting by scope: single sensors, selector-based groups, or fleet-wide deployment. Define your target scope before tasking to deploy commands efficiently across small sets or large heterogeneous fleets with a single operation.

Direct tasking reaches only online sensors with immediate responses, suitable for small targeted operations. Reliable tasking adds offline support and TTL queueing but requires configuration for large or distributed deployments where sensor availability is unpredictable.