LimaCharlie
LimaCharlie: Affordable endpoint-centric response with telemetry, cases, containment, and automation. Ranked #3 of 21 in Incident Response Software by our editors (9.0/10); pricing: Free plan · 14-day trial; best for affordable endpoint-centric response.
At a glance
- Editor score9.0 / 10
- PricingFree plan · 14-day trial
- Best forAffordable endpoint-centric response
- Free planYes
- Paid from$3/device/mo
- Case managementYes
- Facts checked20 Sep 2026
Where it wins
- Free EDR plan and $3-per-endpoint monthly Standard pricing
- Endpoint telemetry, forensics, isolation, process termination, and YARA scans
- Cases, audit logs, APIs, AI workflows, and broad security integrations
Where it doesn't
- Community is limited to two endpoints
- Cases is documented as Public Beta
- Builder Program pricing is custom rather than listed
Our verdict on LimaCharlie
LimaCharlie is a cloud-based security operations platform for incident response teams, MSSPs, enterprise SOCs, and security engineers. It deploys sensors across Windows, macOS, Linux, and ChromeOS, then collects endpoint telemetry, logs, memory captures, and forensic artifacts. Investigators can search retained telemetry, run YARA scans across memory and disk, isolate endpoints, and terminate processes during response. Its Cases extension turns detections into trackable investigations with evidence, assignments, notes, related-case merging, lifecycle management, and MTTA/MTTR reporting.
Pricing covers several operating models. The Community plan provides free EDR for up to 2 endpoints, one year of storage, and Community Discourse support, with no credit card required. Community CNAPP costs $150 per organization monthly and includes a 14-day trial with 2 providers. Standard starts at $3 per endpoint per month, supports unlimited endpoints, includes one year of storage, and adds ticketing and Discourse support. The Builder Program is for MSSPs and includes unlimited endpoints, discounted EDR, CNAPP, and telemetry sources, plus technical account manager, Slack, ticketing, and Discourse support.
LimaCharlie fits teams that want endpoint-centered response with room for investigation workflows and integration. REST API, CLI, and SDK access support cases and workflows, while audit logs record administrative and workflow activity. Integrations include AWS CloudTrail, AWS GuardDuty, AWS S3, Azure Event Hub, Google Cloud Pub/Sub, Google Cloud Storage, Okta, Microsoft Entra ID, Duo, 1Password, CrowdStrike, Microsoft Defender, SentinelOne, Sophos, and Carbon Black. AI-assisted investigation, threat hunting, and response workflows add another automation layer. Choose it for affordable endpoint response and extensibility; teams wanting a fully mature Cases workflow should account for its Public Beta status.
Your product? Our editors can test LimaCharlie in depth and publish a review, labelled as paid · from $149/mo →
LimaCharlie pricing
All 4 LimaCharlie plans and prices →
LimaCharlie fact sheet
| Free plan | Yes |
|---|---|
| Paid from | $3/device/mo |
| Case management | Yes |
| Evidence tracking | Yes |
| Responder collaboration | Yes |
| On-call scheduling | Not verified |
| Audit log | Yes |
| API access | Yes |
| Deployment options | Cloud |
| Free trial | 14 days · no card needed |
| Deployment | Cloud |
| Platforms | Web, Windows, macOS, Linux |
| Compliance & security | SOC 2, GDPR, PCI DSS |
| Support | Tickets, Community, Live chat |
| Built for | Small business, Mid-market, Enterprise (editorial estimate) |
| Integrations | 20 integrations: AWS CloudTrail, AWS GuardDuty, AWS S3, Azure Event Hub, Google Cloud Pub/Sub, Google Cloud Storage … |
| Pricing | Free plan · 14-day trial (source) |
| Website | limacharlie.io |
| Facts checked | 20 Sep 2026 |
LimaCharlie integrations
LimaCharlie lists 20 integrations on its own site.
- AWS CloudTrail
- AWS GuardDuty
- AWS S3
- Azure Event Hub
- Google Cloud Pub/Sub
- Google Cloud Storage
- Okta
- Microsoft Entra ID
- Duo
- 1Password
- CrowdStrike
- Microsoft Defender
- SentinelOne
- Sophos
- Carbon Black
- ThreatLocker
- ServiceNow
- Slack
- Telegram
- Syslog
Alternatives to LimaCharlie
- TheHiveA broad incident response workspace covering triage, investigation, evidence, and reporting.9.4
- DFIR-IRISA focused case-management platform for open-source incident response teams.9.2
- ORNAA broad free tier for small teams that need structured incident response.8.8
See all LimaCharlie alternatives →
LimaCharlie vs the competition
- LimaCharlie vs TheHive
- LimaCharlie vs DFIR-IRIS
- LimaCharlie vs ORNA
- LimaCharlie vs Cydarm
- LimaCharlie vs ServiceNow Security Incident Response
- LimaCharlie vs DFIRe
Compare LimaCharlie with any tool side by side →
Also Ranked In
LimaCharlie is ranked in 3 of our directories.
Used LimaCharlie? Be the first to review it
The editor score above is our own research. What this page doesn't have yet is a reader's view — what you used LimaCharlie for, what worked and what didn't. No stars are seeded and no review is paid for; an editor reads every one before it appears.
Write a reviewTwo minutes · verified accounts only · read by an editor before it appears
Featured on iTechGuides
LimaCharlie is listed in our Incident Response Software directory. Add the badge to your site — it links back to this page.
<a href="https://www.itechguides.com/products/limacharlie/"><img src="https://www.itechguides.com/best/badge/limacharlie.svg" alt="Featured on iTechGuides" width="230" height="46"></a>
Reviewed by iTechGuides Editors · Editorial team · Updated Oct 2026
Advertiser disclosure: iTechGuides is reader-supported. Vendors can pay for top positions in our rankings and for a place on other products' pages, and we may earn a commission when you click some links. Bought places stand at the number bought; this page and our disclosure say so. Paying vendors may get a fuller, more detailed review from our editors, and that review can change their score. How we rank.
Last updated · How we research and update