Telemetry, alerts, audit logs and sensor installs don't belong in the same place, and they don't have to go there.
LimaCharlie sends its data out on four streams: event, detect, audit and deployment. Each output takes one stream to one destination. The type picks the stream, the module picks the destination, and filters decide what gets through. Outputs can be managed from the web app, the REST API, the Python and Go SDKs, or the CLI.
> Detections post to a Slack channel, with a category filter that keeps it to high-priority alerts
> Full event telemetry lands in an S3 bucket, gzipped and filed by year/month/day/hour, or in a BigQuery table
> Your SIEM gets its own output with an allow list, so only the event types you name are sent
> Audit logs go to their own long-term store, separate from operational data
> The deployment stream can catch unexpected sensor uninstalls, a possible sign of evasion
> Or just describe it: Add Output with AI asks what you want to forward and where, walks you through the configuration, creates the output with the CLI, and waits for your approval before it acts
Read the docs: https://docs.limacharlie.io/5-integrations/outputs/