Does it support Windows Event Logs (WEL)?

Absolutely. The skill includes specific patterns for querying WEL by Event ID, logon types, and nested event data fields for deep forensic analysis.

LCQL (LimaCharlie Query Language) is a structured query language used to search and analyze historical security telemetry across sensors and events in the LimaCharlie platform.

Can this skill help reduce query costs?

Yes, it provides optimization strategies such as narrowing time windows, specific sensor selection, and early filtering to minimize the number of events evaluated and billed.

How do I use this skill in the LimaCharlie CLI?

The skill provides guidance on setting context with commands like set_time and set_sensors before executing paged queries (q) or full queries (qa).

What is the structure of an LCQL query?

LCQL queries follow a specific pipeline structure: Time Range | Sensor Selector | Event Type | Filter | Projection.

LCQL Query Builder

Name: LCQL Query Builder
Author: tekgrunt

bytekgrunt

Seguridad y Pruebas

Generates, optimizes, and explains LimaCharlie Query Language (LCQL) queries for advanced security telemetry analysis and threat hunting.

Acerca de

The LCQL Query Builder skill transforms Claude into a specialized SecOps assistant for the LimaCharlie security platform. It provides expert guidance on constructing the five-part LCQL pipeline—Time Range, Sensor Selector, Event Type, Filter, and Projection—ensuring users can effectively search through historical telemetry. Whether you are investigating Windows Event Logs, tracking process ancestry, or auditing cloud activity, this skill helps you write precise, performant queries while managing computational costs and evaluating data structures across different telemetry streams.

Características Principales

Query optimization tips to reduce event evaluation costs
Advanced filtering logic using boolean operators and regex matching
End-to-end LCQL pipeline construction and syntax validation
0 GitHub stars
Multi-platform support for Windows (WEL), Linux, MacOS, and GitHub telemetry
Data aggregation and projection for complex statistical reporting

Casos de Uso

Analyzing Windows Event Logs for failed logons or unauthorized access
Building baseline prevalence reports for DNS requests and binary signatures
Hunting for lateral movement and suspicious process command lines

Acerca de

Características Principales

Query optimization tips to reduce event evaluation costs
Advanced filtering logic using boolean operators and regex matching
End-to-end LCQL pipeline construction and syntax validation
0 GitHub stars
Multi-platform support for Windows (WEL), Linux, MacOS, and GitHub telemetry
Data aggregation and projection for complex statistical reporting

Casos de Uso

Analyzing Windows Event Logs for failed logons or unauthorized access
Building baseline prevalence reports for DNS requests and binary signatures
Hunting for lateral movement and suspicious process command lines