Billing in LimaCharlie is done on monthly cycles and per-Organization (multi-tenant). Sensors can be billed on a quota, set within the organization, or billed on a usage basis.
Some features, such as centralized billing are available to larger LC users like MSSPs. For more details contact us at [email protected].
There are two categories of sensors: sensors billed on Quota set by the user (vSensor basis), and sensors billed on usage basis.
|Sensor Type||Billed on||Cost|
|VMWare Carbon Black EDR||Quota||$0.5/sensor/month|
|Syslog||Usage basis||$0.15 / GB|
|Amazon AWS CloudTrail Logs||Usage basis||$0.15 / GB|
|Google Cloud Platform (GCP) Logs||Usage basis||$0.15 / GB|
|1Password||Usage basis||$0.15 / GB|
|Microsoft/Office 365||Usage basis||$0.15 / GB|
|Windows Event Logs||Usage basis||$0.15 / GB|
|Microsoft Defender||Usage basis||$0.15 / GB|
|Duo||Usage basis||$0.15 / GB|
|GitHub||Usage basis||$0.15 / GB|
|Slack||Usage basis||$0.15 / GB|
|CrowdStrike||Usage basis||$0.15 / GB|
|IT Glue||Usage basis||$0.15 / GB|
|Other external sources||Usage basis||$0.15 / GB|
For more information about vSensors and the examples, visit our help center page.
The Quota is the number of sensors (agents) concurrently online that should be supported by the given Organization. The Quota applies to concurrently online sensors, meaning that you may have more sensors registered than your quota.
If sensors attempt to connect to the cloud while the Quota is full, they will simply be turned away for a short period of time. In that case, a special
sensor_over_quota will also be emitted which you can use in D&R rules for automation.
To avoid frequent churn, Quota modifications are limited by:
- Up to one quota decrease per day.
- Any number of quota increases per day.
Insight is also a foundational service of LimaCharlie. It provides a flat 1 year of full retention (full telemetry) for a single price in order to make billing more predictible.
Replay (Retroactive Scanning)
Its pricing is based on the number of events (telemetry) scanned.
Looking for more insight on utilizing replay?
Pricing is $0.01 per block of 25,000 event. So a query scanning 100,000 events will cost $0.04.
The "dry run" mechanism of Replay can also provide you a high watermark of the cost of a query without actually running it.
Replay jobs can also be launched with a maximum number of operation evaluations to consume during the life-cycle of the job. This limit is aproximate due to the de-centralized nature of Replay jobs and may vary a bit.
Artifacts allows you to ingest artifacts like Syslogs, Windows Events Logs as well as more complex file formats like Packet Captures (PCAP), Windows Prefetch files, Portable Executable (PE) etc.
Ingested files can then be downloaded as originals or viewed in parsed formats right from your browser. You can also run D&R rules against them.
Unlike Insight, the retention period is variable based on a number of days (up to 365) as specified by the user at ingestion time.
All billing for it is done at ingestion time based on the number of days and the size of the file. The billing metric is therefore "byte-days".
For example, a file that is 100 MB and is ingested with a retention period of 10 days would be one-time billed for
100 X 10 MB-days.
LimaCharlie Add-Ons are billed on the vSensor basis. When an add-on is used with a sensor billed on usage (eg., 1Password), the Add-On is free. For more information and the examples, visit our billing FAQ.