LimaCharlie

LimaCharlie describes itself as an API-first SecOps platform for telemetry, detection and response. Its endpoint security tools collect EDR telemetry, monitor process, network, file and user activity, and support YARA scans and automated response. The endpoint agent deploys to Windows, Mac, Linux, Docker, ChromeOS, Chrome and Edge. The platform can ingest structured JSON, Syslog or CEF data, including on-premises data and cloud-to-cloud feeds. Users can define detection criteria and response actions in YAML, then automate work across endpoints, APIs, clouds and multiple tenants. LimaCharlie lists integrations including Tines, Slack, AWS S3, Twilio, Apache Kafka, Azure services, YARA, Velociraptor, VirusTotal, Sigma, AlienVault and PagerDuty. MSSPs can isolate customer environments while centrally managing rules, sensors and automation with granular access controls. Rules, sensors and configurations can be defined in YAML or Terraform with version control, auditability and rollback. Community is free for up to two endpoints; Standard lists EDR at $3 a month per endpoint.

LimaCharlie combines endpoint telemetry with configurable detection and response automation. The free tier has a two-endpoint limit, while the listed Standard EDR rate is $3 a month per endpoint.

LimaCharlie suits security teams seeking telemetry, detection and response tools with automation across endpoints and cloud environments. Its multi-tenant controls are also aimed at MSSPs managing separate customer environments.

Overview

LimaCharlie is a security operations platform that connects endpoint activity and other structured data to detection and response workflows. It suits security teams and managed security service providers (MSSPs) that want to shape those workflows through APIs, YAML and infrastructure as code. Its flexibility is the draw; its two-endpoint free tier is a narrow starting point for organizations that need broad endpoint coverage.

Key features

Endpoint monitoring and response. LimaCharlie collects process, network, file and user activity, supports YARA scans, and can automate responses. Its agent runs on Windows, Mac, Linux, Docker, ChromeOS, Chrome and Edge. That range helps teams bring varied endpoint environments into the same detection workflow. The Community plan, however, allows only two endpoints, so it is better suited to a small evaluation or tightly limited deployment than a broad fleet.

Ingestion and automation. The platform accepts structured JSON, Syslog and CEF data, including on-premises sources and cloud-to-cloud feeds. Users can define detection criteria and response actions in YAML, then automate across endpoints, APIs, clouds and tenants. Named integrations include Tines, Slack, AWS S3, Twilio, Apache Kafka, Azure Event Hub, Azure Storage Blob, YARA, Velociraptor, VirusTotal, Sigma, AlienVault and PagerDuty. This breadth favors teams with specific workflows to connect; it also makes the Standard plan's separate telemetry charge relevant when planning usage.

Tenant and configuration controls. LimaCharlie is designed for MSSPs to separate customer environments while centrally managing rules, sensors and automation with granular access controls. Rules, sensors and configurations can be defined in YAML or Terraform, with version control, auditability and rollback. These capabilities support controlled change across tenants, particularly where configuration needs to be reviewed and reverted.

Security operations workflow. Case management, evidence tracking, responder collaboration, audit logs and API access support incident work alongside telemetry and response. The platform page also names SOC 2 Type II, GDPR, CCPA and PCI-DSS under security and compliance. AI model integrations include Anthropic Claude Code, OpenAI Codex and Google Gemini CLI; customers bring their own provider subscriptions or keys, and provider usage is billed directly without a LimaCharlie markup.

Pricing

LimaCharlie uses a freemium model, with a 14-day trial and month-to-month billing on Standard. The Community tier costs nothing, requires no credit card, and permits up to two endpoints. EDR is free; CNAPP costs $150/organization; telemetry sources are free; storage lasts one year; and support is through community Discourse. It is the low-commitment choice for a small setup, but the endpoint cap rules it out for most larger fleets.

Standard costs $3 a month, billed month-to-month, with payment based on capabilities used. EDR is $3.00/endpoint, with volume pricing at 5,000 endpoints; CNAPP costs $150/organization; telemetry sources cost $0.20/GB; and storage lasts one year. Ticketing and Discourse support are included. This is the more practical tier for teams expanding beyond two endpoints, though endpoint and ingestion usage both affect the bill.

The Builder Program has custom pricing with custom tiered pricing and requires contacting sales. It offers unlimited endpoints, discounted EDR, CNAPP and telemetry sources, one year of storage, and a technical account manager plus Slack, ticketing and Discourse support. It is aimed at larger or more demanding deployments; the Community and Standard tiers do not provide that named account support or unlimited endpoints. AI provider usage remains billed by the provider, so it is separate from LimaCharlie charges.

Platforms

LimaCharlie is available through API, web, Linux, macOS and Windows, with self-hosted also named as a platform option. Its endpoint agent additionally supports Docker, ChromeOS, Chrome and Edge. The platform's deployment option is cloud, so the self-hosted label should not be taken to mean the full service has a self-hosted deployment option.

Who it's for

LimaCharlie fits security teams that want to connect endpoint signals and other structured feeds to configurable detection and response, and MSSPs that need separated customer environments with centralized controls. YAML and Terraform configuration, APIs and integrations are strongest for organizations prepared to build and manage their own operational workflows. Buyers seeking a straightforward standalone incident-response toolkit, or a free service for more than two endpoints, should look elsewhere.

Pros and cons

• Pro: Endpoint telemetry, YARA scans and automated response are combined with ingestion for JSON, Syslog and CEF, giving teams several routes to connect security signals to action.
• Pro: Multi-tenant controls and versioned YAML or Terraform configuration are useful for MSSPs managing rules and sensors across customer environments.
• Pro: The free Community tier includes EDR and one year of storage without requiring a credit card, making a small evaluation possible without endpoint charges.
• Con: Community stops at two endpoints, which sharply limits its value for production fleets.
• Con: Standard separates endpoint, telemetry and CNAPP charges, so teams using multiple capabilities must account for more than the EDR rate alone.
• Con: AI integrations require customer-provided provider subscriptions or keys, and AI usage is billed by those providers rather than included in LimaCharlie pricing.

Alternatives

For a broader set of incident-response options, see Incident Response Software. Choose ORNA if a free self-managed option or a managed platform with a custom quote better matches your deployment. TheHive is worth considering for a self-hosted community setup capped at two users and one organization, or paid per-user tiers. DFIR-IRIS is a free web-based alternative. Cydarm offers a free 30-day trial without a credit card, though some integrations and automations are configured after purchase. Forensicator is a free, open-source cross-platform incident response toolkit. ServiceNow Security Incident Response is a paid web option with custom-quote plans that name incident summarization and post-incident analysis. Binalyze AIR is a paid cross-platform option with a free trial. SandsBytes is another paid option, with API, Linux, self-hosted and web platforms.

Verdict

Choose LimaCharlie if your security team or MSSP needs programmable endpoint detection and response, flexible data ingestion and customer-level separation in one platform. The strongest reason to choose it is the combination of YAML-driven automation and multi-tenant controls; the clearest reason to look elsewhere is the two-endpoint free ceiling and usage-based charges as coverage and ingestion grow.