LimaCharlie

No phone app

7.9No. 1 of 20
in Incident Response Software

Recognised40% of the score90
Phone app26% of the score0
Documented20% of the score90
Free plan14% of the score100

Free plan: Yes
Paid plans from: $3/mo
Runs on: api, Linux, Mac, self-hosted, Web, Windows

Summary

LimaCharlie describes itself as an API-first SecOps platform for telemetry, detection and response. Its endpoint security tools collect EDR telemetry, monitor process, network, file and user activity, and support YARA scans and automated response. The endpoint agent deploys to Windows, Mac, Linux, Docker, ChromeOS, Chrome and Edge. The platform can ingest structured JSON, Syslog or CEF data, including on-premises data and cloud-to-cloud feeds. Users can define detection criteria and response actions in YAML, then automate work across endpoints, APIs, clouds and multiple tenants. LimaCharlie lists integrations including Tines, Slack, AWS S3, Twilio, Apache Kafka, Azure services, YARA, Velociraptor, VirusTotal, Sigma, AlienVault and PagerDuty. MSSPs can isolate customer environments while centrally managing rules, sensors and automation with granular access controls. Rules, sensors and configurations can be defined in YAML or Terraform with version control, auditability and rollback. Community is free for up to two endpoints; Standard lists EDR at 3.00 USD per month per endpoint.

Who it is for

LimaCharlie suits security teams seeking telemetry, detection and response tools with automation across endpoints and cloud environments. Its multi-tenant controls are also aimed at MSSPs managing separate customer environments.

What is good

Collects EDR telemetry and monitors endpoint activity
Ingests JSON, Syslog and CEF data
Automates response across endpoints, APIs and clouds
YAML or Terraform configuration supports version control
Free Community tier includes up to two endpoints

What to know first

Community tier is limited to two endpoints
Standard EDR is 3.00 USD per month per endpoint
Builder Program pricing is custom and requires contacting sales

Verdict

LimaCharlie combines endpoint telemetry with configurable detection and response automation. The free tier has a two-endpoint limit, while the listed Standard EDR rate is 3.00 USD per month per endpoint.

LimaCharlie plans and pricing

All plans

Community Free Free tier; no credit card required Up to 2 endpoints · EDR free · CNAPP $150/organization · 1 year storage · telemetry sources free · community Discourse support limacharlie.io · 29 Sept 2026

Standard $3/mo Month-to-month; pay for capabilities used EDR $3.00/endpoint · volume pricing at 5,000 endpoints · CNAPP $150/organization · telemetry sources $0.20/GB · 1 year storage · ticketing and Discourse support limacharlie.io · 29 Sept 2026

Builder Program Not published Custom tiered pricing; contact sales Unlimited endpoints · discounted EDR, CNAPP, and telemetry sources · 1 year storage · technical account manager, Slack, ticketing, and Discourse support limacharlie.io · 29 Sept 2026

Compared on incident response software

Free plan: Yeslimacharlie.io
Case management: Yeslimacharlie.io
Evidence tracking: Yeslimacharlie.io
Responder collaboration: Yeslimacharlie.io
Audit log: Yeslimacharlie.io
API access: Yeslimacharlie.io
Deployment options: cloudlimacharlie.io

Facts

Purpose: LimaCharlie describes itself as an API-first SecOps platform for telemetry, detection, and response.limacharlie.io · 29 Sept 2026
Endpoint security: Its platform collects EDR telemetry, monitors process, network, file, and user activity, and supports YARA scans and automated response.limacharlie.io · 29 Sept 2026
Supported endpoint environments: The endpoint agent deploys to Windows, Mac, Linux, Docker, ChromeOS, Chrome, and Edge.limacharlie.io · 29 Sept 2026
Data ingestion: The platform can ingest structured data such as JSON, Syslog, or CEF, including on-premises data and cloud-to-cloud feeds.limacharlie.io · 29 Sept 2026
Automation: Users can define detection criteria and response actions in YAML and automate actions across endpoints, APIs, clouds, and multiple tenants.limacharlie.io · 29 Sept 2026
Integrations: The platform page names Tines, Slack, AWS S3, Twilio, Apache Kafka, Azure Event Hub, Azure Storage Blob, YARA, Velociraptor, VirusTotal, Sigma, AlienVault, and PagerDuty.limacharlie.io · 29 Sept 2026
Multi-tenancy: The platform is designed for MSSPs to isolate customer environments while centrally managing rules, sensors, and automation with granular access controls.limacharlie.io · 29 Sept 2026
Infrastructure as code: Detection rules, sensors, and configurations can be defined in YAML or Terraform with version control, auditability, and rollback.limacharlie.io · 29 Sept 2026
AI model integrations: The pricing FAQ names Anthropic Claude Code, OpenAI Codex, and Google Gemini CLI, and says customers provide their own API subscriptions or keys.limacharlie.io · 29 Sept 2026
AI billing: AI provider usage is billed directly by the provider, and LimaCharlie says it does not mark up or resell AI capacity.limacharlie.io · 29 Sept 2026
Security and compliance: The pricing page lists SOC 2 Type II, GDPR, CCPA, and PCI-DSS under security and compliance.limacharlie.io · 29 Sept 2026
Support: Community includes community Discourse support; Standard lists ticketing and Discourse; Builder Program lists a technical account manager, Slack, ticketing, and Discourse.limacharlie.io · 29 Sept 2026
Pricing limits: The Community tier allows up to two endpoints, while the Standard tier lists volume pricing at 5,000 endpoints.limacharlie.io · 29 Sept 2026