Billing

Billing in LimaCharlie is done on monthly cycles and per-Organization (multi-tenant). Sensors can be billed on a quota, set within the organization, or billed on a usage basis.

Exact pricing is available on the LimaCharlie website or Web App.

Services

Sensors

There are two categories of sensors: sensors billed on Quota set by the user (vSensor basis), and sensors billed on usage basis.

For more information about vSensors and the examples, visit our help center page.

The Quota is the number of sensors (agents) concurrently online that should be supported by the given Organization. The Quota applies to concurrently online sensors, meaning that you may have more sensors registered than your quota.

If sensors attempt to connect to the cloud while the Quota is full, they will simply be turned away for a short period of time. In that case, a special sensor_over_quota will also be emitted which you can use in D&R rules for automation.

To avoid frequent churn, Quota modifications are limited by:

• Up to one quota decrease per day.
• Any number of quota increases per day.

The endpoint service includes Outputs as well as D&R rules processed in real-time.

Insight (Retention)

Insight is also a foundational service of LimaCharlie. It provides a flat 1 year of full retention (full telemetry) for a single price in order to make billing more predictible.

Usage Based Billing

See Sleeper Deployment for more details.

Replay (Retroactive Scanning)

Replay allows you to run D&R rules or False Positives against external or historical telemetry. Not to be confused with Searching for specific IoCs which is a free feature of Insight.

Its pricing is based on the number of events (telemetry) scanned.

Looking for more insight on utilizing replay?

Pricing is $0.01 per block of 25,000 event. So a query scanning 100,000 events will cost $0.04.

The "dry run" mechanism of Replay can also provide you a high watermark of the cost of a query without actually running it.

Replay jobs can also be launched with a maximum number of operation evaluations to consume during the life-cycle of the job. This limit is aproximate due to the de-centralized nature of Replay jobs and may vary a bit.

Artifact Collection

Artifacts allows you to ingest artifacts like Syslogs, Windows Events Logs as well as more complex file formats like Packet Captures (PCAP), Windows Prefetch files, Portable Executable (PE) etc.

Ingested files can then be downloaded as originals or viewed in parsed formats right from your browser. You can also run D&R rules against them.

Unlike Insight, the retention period is variable based on a number of days (up to 365) as specified by the user at ingestion time.

All billing for it is done at ingestion time based on the number of days and the size of the file. The billing metric is therefore "byte-days".

For example, a file that is 100 MB and is ingested with a retention period of 10 days would be one-time billed for 100 X 10 MB-days.

Add-Ons

LimaCharlie Add-Ons are billed on the vSensor basis. When an add-on is used with a sensor billed on usage (eg., 1Password), the Add-On is free. For more information and the examples, visit our billing FAQ.