What do I need to get started?

You need the lc-essentials plugin installed and should run the /init-lc command to initialize your LimaCharlie organization context.

What is the LimaCharlie Parsing Helper?

It is a specialized Claude Code skill that automates the process of creating and testing Grok patterns to normalize log data within the LimaCharlie security platform.

Which LimaCharlie adapters are supported?

The skill supports Cloud Sensors (AWS, Azure, GCP, SaaS), External Adapters (Syslog, Webhooks, API), and local USP Adapters.

How does it handle timezone mismatches?

It automatically compares parsed event timestamps against current UTC time and warns users if a local timezone offset is detected, which is critical for accurate forensic timelines.

Can I test my parsing rules before deploying them?

Yes, the skill includes a validation phase that uses the validate_usp_mapping API to test your Grok patterns against actual log samples before they are applied.

LimaCharlie Parsing Helper

Name: LimaCharlie Parsing Helper
Author: refractionPOINT

byrefractionPOINT

•

分析与监控

Streamlines the creation, testing, and deployment of Grok parsing patterns for LimaCharlie log adapters.

关于

The LimaCharlie Parsing Helper is a comprehensive workflow designed to normalize log data ingested into the LimaCharlie platform. It guides users through a structured process of organization selection, adapter discovery, and sample log collection to generate precise Grok patterns. The skill includes advanced features like automatic timezone mismatch detection and real-time validation against sample data, ensuring that security logs are correctly parsed, timestamped, and ready for analysis without manual configuration errors.

主要功能

Guided 5-phase workflow for end-to-end parsing configuration
Automatic Grok pattern generation from raw log samples
Real-time validation of parsing rules using the LimaCharlie API
Intelligent timezone detection to prevent UTC synchronization issues
Support for Cloud Sensors, External Adapters, and local USP Adapters
2 GitHub stars

使用场景

Setting up log normalization for a new firewall or application log source
Troubleshooting 'unknown_event' errors where logs aren't being parsed correctly
Updating existing adapter configurations to extract new security fields

关于

主要功能

Guided 5-phase workflow for end-to-end parsing configuration
Automatic Grok pattern generation from raw log samples
Real-time validation of parsing rules using the LimaCharlie API
Intelligent timezone detection to prevent UTC synchronization issues
Support for Cloud Sensors, External Adapters, and local USP Adapters
2 GitHub stars

使用场景

Setting up log normalization for a new firewall or application log source
Troubleshooting 'unknown_event' errors where logs aren't being parsed correctly
Updating existing adapter configurations to extract new security fields