LimaCharlie

Overview

LimaCharlie is an API-first security operations platform for teams that want to collect endpoint and other security data, define detections, and automate responses. It is especially well suited to security operations teams and MSSPs managing multiple customer environments. Its appeal is the ability to shape workflows in code; its practical trade-off is Standard pricing that scales with endpoints, telemetry, and chosen capabilities.

Key features

Endpoint telemetry and response. The agent monitors process, network, file, and user activity, supports YARA scans, and can trigger automated responses. It deploys across Windows, Mac, Linux, Docker, ChromeOS, Chrome, and Edge. That breadth is useful when a team needs detections tied to endpoint activity across varied environments. Community includes free EDR but caps use at two endpoints, so it is better suited to evaluation or a very small footprint than a broad rollout.

Ingestion and automation. LimaCharlie accepts structured JSON, Syslog, and CEF data from on-premises systems and cloud-to-cloud feeds. Detection criteria and response actions can be written in YAML, with automation spanning endpoints, APIs, clouds, and tenants. Named integrations include Tines, Slack, AWS S3, Twilio, Apache Kafka, Azure Event Hub, Azure Storage Blob, YARA, Velociraptor, VirusTotal, Sigma, AlienVault, and PagerDuty. This is a strong fit for teams assembling their own operational workflows; it also makes the cost of telemetry and selected capabilities important to track.

Multi-tenant operations and configuration. MSSPs can isolate customer environments while centrally managing rules, sensors, and automation with granular access controls. Detection rules, sensors, and configurations can also be maintained in YAML or Terraform with version control, auditability, and rollback. These controls suit providers and teams that need repeatable deployments and a clear change history, rather than buyers looking for a narrowly focused response utility.

Operations and integrations. Case management, evidence tracking, responder collaboration, audit logs, and API access support incident workflows alongside the detection platform. The pricing FAQ names Anthropic Claude Code, OpenAI Codex, and Google Gemini CLI integrations; customers supply their own API subscriptions or keys, and provider usage is billed directly without a LimaCharlie markup. Security and compliance offerings include SOC 2 Type II, GDPR, CCPA, and PCI-DSS.

Pricing

LimaCharlie is freemium, with a 14-day trial and a free Community tier. Standard starts at $3 a month, but its endpoint and telemetry charges mean the starting figure is not a flat price for every deployment.

• Community — free. The free tier requires no credit card and allows up to two endpoints, with EDR free. It includes CNAPP at $150/organization, telemetry sources free, one year of storage, and community Discourse support. The endpoint ceiling makes it a sensible low-cost way to assess the platform, but not a free route to a larger endpoint estate.
• Standard — $3 a month, billed month-to-month. Customers pay for capabilities used: EDR is $3.00/endpoint, with volume pricing at 5,000 endpoints; CNAPP is $150/organization; telemetry sources are $0.20/GB. One year of storage and ticketing and Discourse support are included. Month-to-month billing avoids a stated long-term term, while the usage-based charges require teams to account for both endpoint count and incoming data.
• Builder Program — custom pricing. This custom tiered plan is arranged through sales and includes unlimited endpoints, discounted EDR, CNAPP, and telemetry sources, one year of storage, plus a technical account manager, Slack, ticketing, and Discourse support. It suits larger builders that need scale and closer technical support, but requires a sales conversation rather than a published price.

Platforms

LimaCharlie offers cloud deployment and lists API, Linux, macOS, self-hosted, web, and Windows among its platforms. The endpoint agent also supports Docker, ChromeOS, Chrome, and Edge. This mix accommodates teams working across endpoint and cloud environments, while the platform's API-first approach is particularly relevant to those integrating security operations into existing systems.

Who it's for

LimaCharlie is a strong candidate for security teams that want to combine endpoint telemetry with programmable detection and response, and for MSSPs that need customer separation with centralized administration. YAML and Terraform support also favor teams that manage security configuration as code. A buyer seeking a simple, standalone incident-response toolkit, or an organization unwilling to monitor endpoint and telemetry consumption, may be better served elsewhere.

Pros and cons

• Pro: Broad telemetry and response workflows. Endpoint monitoring, structured-data ingestion, YARA scans, and automation across endpoints, APIs, clouds, and tenants bring several SecOps tasks into one programmable platform.
• Pro: Built for multi-customer management. Tenant isolation, granular access controls, and central management of rules, sensors, and automation address concrete MSSP needs.
• Pro: Free entry point and month-to-month Standard. Community has no credit-card requirement and includes free EDR for up to two endpoints; Standard is billed month-to-month.
• Con: Community is tightly capped. Two endpoints make the free tier unsuitable for larger deployments.
• Con: Standard costs depend on usage. EDR is priced per endpoint and telemetry per gigabyte, alongside an organization-level CNAPP charge, so teams must consider more than the monthly starting price.
• Con: Builder Program requires a sales contact. Its unlimited endpoints and discounted capabilities may suit larger needs, but the plan uses custom pricing.

Alternatives

For a broader comparison, see Incident Response Software.

• Forensicator is a free, open-source, cross-platform incident response toolkit; choose it when a free toolkit is a better fit than LimaCharlie's paid, usage-based SecOps platform.
• GRR Rapid Response offers a free Apache License 2.0 self-hosted option; consider it when self-hosting and open-source licensing are priorities.
• ORNA has a self-managed free plan and a managed custom-quote option; consider it when those deployment and pricing options better match your needs.
• Binalyze AIR is a paid product with a free trial; consider it if you want to compare another trial-eligible option.
• SandsBytes is a paid alternative.
• Colander is a free alternative.
• Forendi is a paid option with a free trial and a Threat Intelligence Feed priced at $199 a month; consider it when that feed is the requirement.
• OpenText Universal Discovery and CMDB is a paid product with licensing based on environment and deployment needs; consider it when those licensing terms better suit your deployment.

Verdict

Choose LimaCharlie if your security team or MSSP needs endpoint telemetry, flexible data ingestion, programmable response, and tenant-aware operations in one platform. Its free Community tier offers a limited entry point, while Standard provides a month-to-month path beyond two endpoints. Look elsewhere if you need a free deployment at scale or prefer not to manage charges that vary with endpoints and telemetry.