Digging under the hood, hey there's a Linux VM and a Chrome browser. This is really cool because it essentially defines an environment that is really similar to a typical workstation.
After some playing around I got the LimaCharlie EDR installed, the Chrome LC EDR installed and the email provider connected to the LC Email Security. Took a few iteration to make it all smooth but it works great on the free community edition!
So you get to see what is executing on the box, where the bot is browsing and emails in and out. I built a couple detections using AI and just made it a doc in our documentation so you can just tell Grok Bot:
""" Secure my Grok Bot with LimaCharlie by following https://docs.limacharlie.io/grok-bot/ """
The TL;DR; of what it does: - all of it goes to your own private tenant - installs a linux EDR on the box - installs a Chrome extension that is essentially an EDR in your browser - if you want, connects your gmail (any IMAP is supported really) and is like an EDR for the email - If you want it sends the alerts to your Grok Bot (I'm curious to see the advantage of a feedback loop here), or it's available on the web app.limacharlie.io
The other option I left in was to leave the CLI authenticated on the Grok Bot. The interesting bit about that is that because the CLI has 100% coverage of the platform, you can ask the Grok Bot to start setting up new alerts, investigate alerts, configure everything...
I tried to make it more generic for other AI agents where I have no idea what the environment is: https://docs.limacharlie.io/2-sensors-deployment/tutorials/s... though disclaimer I have not tried it yet, but it's not rocket science and more frontier AI models are now rocket scientists.
The advantage that Grok Bot has is that it fundamentally allows things to execute on the VM and talk out. The other ones (Muse, Dots) seem to proxy every single thing and generally be extremely difficult to extend.
Anyway, hope it helps some of you! (and yes, got it to make a cool video :D) https://youtu.be/yZZuBgKWd1k