Ship a Working Detection Pipeline in One Workshop: Headless SOC with Grid by LimaCharlie

In this hands-on workshop, Ken Westin deploys a working detection pipeline, ingests a cloud log source, and ships a bespoke dashboard app, all using Claude Code integrated with Grid by LimaCharlie. Along the way, he shows how Grid compresses the traditional SIEM/EDR/SOAR stack into a single automated workspace.

The session goes well beyond standard EDR and SIEM use cases. What the workshop covers:

• •Detection engineering: Authoring, replaying, and tuning Detection & Response rules with AI-assisted generation, suppressing false positives, and validating rules against historical telemetry with replay.
• •Cloud operations: Automating deployment of EDR agents and configuring cloud telemetry ingestion into the LimaCharlie platform.
• •Analyst-facing tooling: Building and shipping a custom dashboard app on top of the new pipeline.

No prior LimaCharlie experience is needed to follow along; a Claude Code license is required to work through the steps yourself.