LIMA CHARLIE (LC) is an Open Source, crossplatform endpoint security monitoring and mitigation solution focusing on detecting and prosecuting APTs. The endpoint sensors communicate in nearreal time with a cloud software stack. Detection and monitoring capabilities are implemented mostly in the cloud and to a lesser extent in the sensor. By “going live” on the sensor, operators are also able to perform live investigations and mitigation. LC focuses on providing quick detection capability development, easy integration with other industry products tighter detectioninvestigation cycles. This talk with provide an overview of LC as a platform. A live portion will demonstrate a reallife scenario where an anomaly is detected, investigated, detection modules are generated and the threat is prosecuted. LC is provided under Apache v2 license and can be found at: http://github.com/refractionpoint/limacharlie