> ## Documentation Index
> Fetch the complete documentation index at: https://docs.neoagent.io/llms.txt
> Use this file to discover all available pages before exploring further.

# LOLRMM API

> Read LOLRMM's catalog of remote monitoring, management and remote access tools that attackers abuse

The common use is a remote access tool check: a scheduled agent reads the software installed on each client's devices from the RMM, matches it to LOLRMM's catalog, and lists the tools the MSP did not approve. An agent can also note on a security ticket which remote access tools the device runs.

> [!NOTE]
>
> Automatically enabled when you configure LOLRMM permissions in your agent workflow.

## What It Does

* Read the whole catalog: about 360 tools, each with its category (RMM or remote access tool), supported platforms, install folders, executables, network domains, registry and event log artifacts, and references
* Read one tool's record
* Read the network domains of every tool, and the code-signing evidence LOLRMM collected
* Read LOLRMM's Sigma rules that detect the tools' processes and DNS queries
* Match a device's installed programs to the catalog by name and install folder, with the MSP's approved tools counted apart

Neo keeps its own copy of LOLRMM's feeds, refreshed every six hours, and answers every call from it. So no question your agents ask, and no data from your tickets or devices, reaches LOLRMM.

## Permission Groups

| Group | Access levels | Covers |
| - | - | - |
| Remote Access Tool Catalog | Disabled, Read Only | All seven LOLRMM feeds and the one-tool record: the catalog in JSON and CSV, the domains, the certificates, the count and the two Sigma rules |

## Setup

See [Connecting LOLRMM to Neo](https://docs.neoagent.io/integrations/lolrmm/connecting-to-neo.md).


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.