LimaCharlie
Ranked in Incident Response Software ·Free plan· paid from $3/mo
About
LimaCharlie is an API-first SecOps platform for telemetry, detection, and response. Its endpoint tools collect EDR telemetry, monitor process, network, file, and user activity, and support YARA scans and automated response. The agent deploys to Windows, Mac, Linux, Docker, ChromeOS, Chrome, and Edge. The platform ingests structured JSON, Syslog, or CEF data, including on-premises sources and cloud-to-cloud feeds. Users can express detection criteria and response actions in YAML, automate across endpoints, APIs, clouds, and tenants, and manage rules and configurations through YAML or Terraform with version control, auditability, and rollback. Its listed integrations include Tines, Slack, AWS S3, Twilio, Apache Kafka, Azure services, YARA, Velociraptor, VirusTotal, Sigma, AlienVault, and PagerDuty. Multi-tenancy supports MSSPs isolating customer environments while centrally managing rules and sensors. Community is free for up to two endpoints; Standard lists EDR at 3.00 USD per endpoint per month.
Who it is for
LimaCharlie suits security teams that need telemetry, detection, and response across endpoints and structured data sources. Its multi-tenant management is aimed at MSSPs handling separate customer environments.
What is good
- Endpoint agent supports Windows, Mac, Linux, and more.
- Ingests JSON, Syslog, and CEF data.
- Detection and response can be defined in YAML.
- Supports configuration management through YAML or Terraform.
- Security listings include SOC 2 Type II and GDPR.
What to know first
- Community tier allows up to two endpoints.
- Standard lists telemetry sources at $0.20/GB.
- AI provider usage is billed directly by the provider.
Verdict
LimaCharlie pairs endpoint monitoring with data ingestion, automation, and infrastructure-as-code controls. The free tier has a small endpoint allowance, while Standard prices EDR per endpoint.
Compared on incident response software
- Free plan
- Yeslimacharlie.io
- Case management
- Yeslimacharlie.io
- Evidence tracking
- Yeslimacharlie.io
- Responder collaboration
- Yeslimacharlie.io
- Audit log
- Yeslimacharlie.io
- API access
- Yeslimacharlie.io
- Deployment options
- cloudlimacharlie.io
Facts
- Purpose
- LimaCharlie describes itself as an API-first SecOps platform for telemetry, detection, and response.limacharlie.io · 29 Sept 2026
- Endpoint security
- Its platform collects EDR telemetry, monitors process, network, file, and user activity, and supports YARA scans and automated response.limacharlie.io · 29 Sept 2026
- Supported endpoint environments
- The endpoint agent deploys to Windows, Mac, Linux, Docker, ChromeOS, Chrome, and Edge.limacharlie.io · 29 Sept 2026
- Data ingestion
- The platform can ingest structured data such as JSON, Syslog, or CEF, including on-premises data and cloud-to-cloud feeds.limacharlie.io · 29 Sept 2026
- Automation
- Users can define detection criteria and response actions in YAML and automate actions across endpoints, APIs, clouds, and multiple tenants.limacharlie.io · 29 Sept 2026
- Integrations
- The platform page names Tines, Slack, AWS S3, Twilio, Apache Kafka, Azure Event Hub, Azure Storage Blob, YARA, Velociraptor, VirusTotal, Sigma, AlienVault, and PagerDuty.limacharlie.io · 29 Sept 2026
- Multi-tenancy
- The platform is designed for MSSPs to isolate customer environments while centrally managing rules, sensors, and automation with granular access controls.limacharlie.io · 29 Sept 2026
- Infrastructure as code
- Detection rules, sensors, and configurations can be defined in YAML or Terraform with version control, auditability, and rollback.limacharlie.io · 29 Sept 2026
- AI model integrations
- The pricing FAQ names Anthropic Claude Code, OpenAI Codex, and Google Gemini CLI, and says customers provide their own API subscriptions or keys.limacharlie.io · 29 Sept 2026
- AI billing
- AI provider usage is billed directly by the provider, and LimaCharlie says it does not mark up or resell AI capacity.limacharlie.io · 29 Sept 2026
- Security and compliance
- The pricing page lists SOC 2 Type II, GDPR, CCPA, and PCI-DSS under security and compliance.limacharlie.io · 29 Sept 2026
- Support
- Community includes community Discourse support; Standard lists ticketing and Discourse; Builder Program lists a technical account manager, Slack, ticketing, and Discourse.limacharlie.io · 29 Sept 2026
- Pricing limits
- The Community tier allows up to two endpoints, while the Standard tier lists volume pricing at 5,000 endpoints.limacharlie.io · 29 Sept 2026
Company
- Headquarters
- Covina, California, United States; Vancouver, British Columbia, Canadalimacharlie.io · 28 Sept 2026
Best LimaCharlie alternatives
See all 20
Where it ranks on Inferse
Sources
- limacharlie.io· checked 29 Sept 2026
- limacharlie.io/platform· checked 29 Sept 2026
- limacharlie.io/pricing· checked 29 Sept 2026