Does it support Windows Event Logs (WEL)?

Absolutely. The skill includes specific patterns for querying WEL by Event ID, logon types, and nested event data fields for deep forensic analysis.

LCQL (LimaCharlie Query Language) is a structured query language used to search and analyze historical security telemetry across sensors and events in the LimaCharlie platform.

Can this skill help reduce query costs?

Yes, it provides optimization strategies such as narrowing time windows, specific sensor selection, and early filtering to minimize the number of events evaluated and billed.

How do I use this skill in the LimaCharlie CLI?

The skill provides guidance on setting context with commands like set_time and set_sensors before executing paged queries (q) or full queries (qa).

What is the structure of an LCQL query?

LCQL queries follow a specific pipeline structure: Time Range | Sensor Selector | Event Type | Filter | Projection.

LCQL Query Builder

Name: LCQL Query Builder
Author: tekgrunt

bytekgrunt

0•

安全与测试

Generates, optimizes, and explains LimaCharlie Query Language (LCQL) queries for advanced security telemetry analysis and threat hunting.

The LCQL Query Builder skill transforms Claude into a specialized SecOps assistant for the LimaCharlie security platform. It provides expert guidance on constructing the five-part LCQL pipeline—Time Range, Sensor Selector, Event Type, Filter, and Projection—ensuring users can effectively search through historical telemetry. Whether you are investigating Windows Event Logs, tracking process ancestry, or auditing cloud activity, this skill helps you write precise, performant queries while managing computational costs and evaluating data structures across different telemetry streams.

主要功能

01Query optimization tips to reduce event evaluation costs

02Advanced filtering logic using boolean operators and regex matching

03End-to-end LCQL pipeline construction and syntax validation

040 GitHub stars

05Multi-platform support for Windows (WEL), Linux, MacOS, and GitHub telemetry

06Data aggregation and projection for complex statistical reporting

使用场景

01Analyzing Windows Event Logs for failed logons or unauthorized access

02Building baseline prevalence reports for DNS requests and binary signatures

03Hunting for lateral movement and suspicious process command lines

What are Skills?·How to Install

Install with 🐟 Skill.Fish

npx skillfish add tekgrunt/boot-test lcql-query-builder

For use in Claude.ai and ChatGPT

Download Skill