LimaCharlie review
Affordable endpoint-centric response with telemetry, cases, containment, and automation.
Reviewed by iTechGuides Editors · Editorial team · Updated Oct 2026
LimaCharlie is a cloud-based security operations platform for incident response teams, MSSPs, enterprise SOCs, and security engineers. It deploys sensors across Windows, macOS, Linux, and ChromeOS, then collects endpoint telemetry, logs, memory captures, and forensic artifacts. Investigators can search retained telemetry, run YARA scans across memory and disk, isolate endpoints, and terminate processes during response. Its Cases extension turns detections into trackable investigations with evidence, assignments, notes, related-case merging, lifecycle management, and MTTA/MTTR reporting.
Pricing covers several operating models. The Community plan provides free EDR for up to 2 endpoints, one year of storage, and Community Discourse support, with no credit card required. Community CNAPP costs $150 per organization monthly and includes a 14-day trial with 2 providers. Standard starts at $3 per endpoint per month, supports unlimited endpoints, includes one year of storage, and adds ticketing and Discourse support. The Builder Program is for MSSPs and includes unlimited endpoints, discounted EDR, CNAPP, and telemetry sources, plus technical account manager, Slack, ticketing, and Discourse support.
LimaCharlie fits teams that want endpoint-centered response with room for investigation workflows and integration. REST API, CLI, and SDK access support cases and workflows, while audit logs record administrative and workflow activity. Integrations include AWS CloudTrail, AWS GuardDuty, AWS S3, Azure Event Hub, Google Cloud Pub/Sub, Google Cloud Storage, Okta, Microsoft Entra ID, Duo, 1Password, CrowdStrike, Microsoft Defender, SentinelOne, Sophos, and Carbon Black. AI-assisted investigation, threat hunting, and response workflows add another automation layer. Choose it for affordable endpoint response and extensibility; teams wanting a fully mature Cases workflow should account for its Public Beta status.
LimaCharlie pros and cons
- Where it wins
- Free EDR plan and $3-per-endpoint monthly Standard pricing
- Endpoint telemetry, forensics, isolation, process termination, and YARA scans
- Cases, audit logs, APIs, AI workflows, and broad security integrations
- Where it doesn't
- Community is limited to two endpoints
- Cases is documented as Public Beta
- Builder Program pricing is custom rather than listed
LimaCharlie fact sheet, pricing and score →
Advertiser disclosure: iTechGuides is reader-supported. Vendors can pay for top positions in our rankings and for a place on other products' pages, and we may earn a commission when you click some links. Bought places stand at the number bought; this page and our disclosure say so. Paying vendors may get a fuller, more detailed review from our editors, and that review can change their score. How we rank.
Last updated · How we research and update