skills.rest
skywatch-bsky
skywatch-bskyOFFICIAL
Explore all skills by this author →
WebsiteGitHub

querying-clickhouse

Execute safe analytical SQL queries against ClickHouse event data.

6|Updated Feb 21, 2026
Search Tags:#investigation#security#sql#data-analysis#clickhouse#osprey
One-click install
npx skills add https://github.com/skywatch-bsky/skywatch-agent-skills --skill querying-clickhouse
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: querying-clickhouse
Source: https://github.com/skywatch-bsky/skywatch-agent-skills/tree/main/claude-skills/plugins/skywatch-investigations/skills/querying-clickhouse
Command: npx skills add https://github.com/skywatch-bsky/skywatch-agent-skills --skill querying-clickhouse

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve?

This skill provides the necessary patterns and safety constraints to query the Osprey platform's wide-event ClickHouse tables without causing performance degradation or violating data access policies.

Core Features & Use Cases

  • Safety Enforcement: Provides pre-validated query patterns that adhere to strict SELECT-only, LIMIT-required, and timeout constraints.
  • Schema Navigation: Offers guidance on navigating the 600+ dynamic columns of the osprey_execution_results table, including system columns and rule-specific metrics.
  • Investigation Workflows: Includes proven patterns for account behavior analysis, bot detection, content similarity searches, and coordinated network investigation.

Quick Start

Use the querying-clickhouse skill to find all rule hits for a specific account handle in the last 24 hours.

Frequently Asked Questions about querying-clickhouse

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I run safe SQL queries for ClickHouse data analysis without impacting system performance?▼

Safe ClickHouse data analysis requires enforcing SELECT-only operations, mandatory time-partitioning filters, and result set limits. This skill provides pre-validated SQL templates that enforce these constraints to query the Osprey database without causing performance degradation.

What is the best way to investigate account behavior patterns in ClickHouse event databases?▼

Investigating account behavior in ClickHouse involves using structured SQL templates to analyze the osprey_execution_results table. You can query specific account handles, review rule hits over defined timeframes, and identify coordinated activity patterns safely.

How do I navigate a wide-event ClickHouse table with over 600 dynamic columns?▼

Navigating a 600+ column ClickHouse table requires understanding the distinction between system columns and rule-specific metrics. This skill provides schema navigation guidance to help you identify and query the exact dynamic columns needed for your analysis.

Can I use standard SQL for bot detection and content similarity searches in the Osprey platform?▼

Yes, you can use structured SQL for bot detection and content similarity searches in Osprey. The skill supplies proven query patterns specifically designed to investigate coordinated networks and identify automated account behavior within the ClickHouse event database.

What constraints apply when querying the Osprey ClickHouse database for security investigations?▼

Querying the Osprey ClickHouse database enforces strict read-only operations, mandatory time-partitioning filters, and result set limits. These constraints ensure system stability and prevent data access policy violations during security investigations.

Related Skills

Explore More Data & Analytics Skills→
tharunramagiritharunramagiri

add-whatsapp-cloud

Integrate the Meta WhatsApp Business Cloud API for 1:1 messaging.

Community
Intermediate
skywatch-bskyskywatch-bsky
6

skywatch-accessing-osprey

Query Osprey moderation rule execution data and sidecar statistics in ClickHouse.

Official
Advanced
JansenAnalyticsJansenAnalytics
5

error-monitor

Monitor application logs and stderr to detect errors, crashes, and exceptions.

Community
Intermediate
ZouZouZouZou

Advanced Search & Filtering

Implement full-text search and multi-criteria filtering for course catalogs.

Community
Advanced