skills.rest
tekgrunt
tekgruntCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

lcql-query-builder

Write, optimize, and explain LCQL queries for LimaCharlie security telemetry analysis.

Updated Nov 5, 2025
Search Tags:#data-analysis#telemetry#threat-hunting#query-language#lcql#security-telemetry
One-click install
npx skills add https://github.com/tekgrunt/boot-test --skill lcql-query-builder
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: lcql-query-builder
Source: https://github.com/tekgrunt/boot-test/tree/main/.claude-plugin/plugins/limacharlie-skills/skills/lcql-query-builder
Command: npx skills add https://github.com/tekgrunt/boot-test --skill lcql-query-builder

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Writing, optimizing, and understanding LimaCharlie Query Language (LCQL) queries for security telemetry can be time-consuming and error-prone without guided assistance.

Core Features & Use Cases

  • Guided LCQL construction: Assist in composing accurate queries for common telemetry patterns.
  • Query optimization: Suggest efficient time ranges, sensor selectors, and filters to reduce cost and improve results.
  • Use Case: Threat hunting across LimaCharlie event streams to identify suspicious command lines, DNS queries, and network activity with minimal effort.

Quick Start

Describe your data and objective, and I will generate a ready-to-run LCQL query tailored to your needs.

Frequently Asked Questions about lcql-query-builder

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I write LCQL queries for LimaCharlie security telemetry?▼

To write LCQL queries, you define time ranges, sensor selectors, event types, filters, and projections. This Skill generates ready-to-run queries tailored to your security telemetry objectives, streamlining the query building process for LimaCharlie data streams.

What is the best way to optimize LCQL queries for threat hunting?▼

Optimizing LCQL queries involves refining time ranges, sensor selectors, and filters to reduce analysis costs and improve result accuracy. This Skill suggests efficient query structures for threat hunting across LimaCharlie event streams to identify suspicious activity with minimal effort.

Can I use LCQL to hunt for suspicious DNS queries and command lines?▼

Yes, LCQL is used to hunt across LimaCharlie event streams for suspicious command lines, DNS queries, and network activity. This Skill helps compose the necessary filters and projections to isolate these specific threat patterns during incident investigations.

What components are required when constructing a LimaCharlie query?▼

Constructing a LimaCharlie query requires specifying time ranges, sensor selectors, event types, filters, and projections. This Skill ensures all required query components are satisfied with practical guidance for accurate telemetry research.

Does guided LCQL construction help with incident investigations?▼

Guided LCQL construction assists in composing accurate queries for common telemetry patterns during incident investigations. It streamlines security telemetry analysis by applying necessary query parameters to quickly identify relevant threats across LimaCharlie data streams.

Related Skills

Explore More Data & Analytics Skills→
refractionPOINTrefractionPOINT
29

velociraptor

Launch Velociraptor forensic collections on endpoints via LimaCharlie API.

Official
Advanced
backbay-labsbackbay-labs
285

Threat Hunt

Automate security event investigation and threat hunting workflows.

Official
Advanced
tekgrunttekgrunt

performance-optimizer

Optimize LimaCharlie deployments to reduce costs while maintaining security coverage.

Community
Advanced
balsm-healthbalsm-health
2

hunting-for-unusual-network-connections

Analyze EDR, SIEM, and Sysmon logs for unusual network connections.

Official
Advanced