LimaCharlie Query Builder

Build LCQL queries and CLI commands without memorizing syntax.

0. Setup & authentication

Set your credentials as environment variables, then log in. Do this once per session.

Step 1 — set environment variables

$env:LC_OID = "YOUR_OID_HERE"
$env:LC_API_KEY = "YOUR_API_KEY_HERE"

Step 2 — log in

limacharlie auth login --oid $env:LC_OID --api-key $env:LC_API_KEY

Step 3 — suppress legacy config warning (optional)

$env:LC_NO_MIGRATION_WARNING = "1"

OID and API key: LC web UI → Access Management → REST API.

1. Time range

Mode

Look back

2. Sensor selector

Type

Sensor

or paste SID

3. Event type

4. Filters

Combine with

No filters added.

Quick-add common fields

5. Projection (optional)

Common fields

LCQL query

PowerShell — limacharlie search run

PowerShell — limacharlie event list (SID required)