Dagobert
5.5#16 in incident response softwareWebAPILinuxSelf-hosted
VisitDagobert vs LimaCharlie
LimaCharlie
7.2#6 in endpoint security software$3 usage-basedFree planWebAPILinuxmacOS
VisitWhat both publish
| Fact | Dagobert | LimaCharlie |
|---|---|---|
| Automation | Hooks can trigger automations when records are created or updated, with conditions written as expr expressions. | Users can define detection criteria and response actions in YAML and automate actions across endpoints, APIs, clouds, and multiple tenants. |
| Integrations | Indicator enrichment can query VirusTotal, AbuseIPDB, and Hybrid Analysis, and Dagobert can exchange timelines with Timesketch. | The platform page names Tines, Slack, AWS S3, Twilio, Apache Kafka, Azure Event Hub, Azure Storage Blob, YARA, Velociraptor, VirusTotal, Sigma, AlienVault, and PagerDuty. |
| Purpose | Dagobert provides incident response teams a shared workspace for forensic investigations, including findings, timelines, tasks, notes, and report generation. | LimaCharlie describes itself as an API-first SecOps platform for telemetry, detection, and response. |
| Support | The README directs users to open a GitHub issue for questions and bug reports. | Community includes community Discourse support; Standard lists ticketing and Discourse; Builder Program lists a technical account manager, Slack, ticketing, and Discourse. |
Dagobert plans
No prices published.
LimaCharlie plans
- CommunityFree
- Standard$3 a month
- Builder ProgramPriced on request
Pick Dagobert if…
Dagobert is primarily intended for DFIR consultants handling cases for outside clients, with internal CIRT and SOC teams as a secondary audience. It suits teams able to self-host and manage access and deployment security.
Pick LimaCharlie if…
It suits security teams seeking endpoint telemetry, detection, and response tools, as well as MSSPs managing separate customer environments. Teams can also define rules and configurations in YAML or Terraform.