How to Export LimaCharlie Logs for Investigation
Summary
A practical guide shows how to query LimaCharlie Insight with its CLI, export JSON events for a chosen host and time range, and route ongoing data to storage or SIEM destinations. It also covers query costs, permissions, and one-year retention.
Key points
- The LimaCharlie CLI can run LCQL queries and export matching events as JSON.
- Queries can be narrowed by platform, event type, hostname, and time range; dry runs estimate scan costs.
- Events use a routing-and-event structure, and JSON arrays can be flattened with jq.
- Outputs can continuously send events, detections, or audit logs to S3, Google Cloud Storage, a SIEM, or a webhook.
- Insight retains one year of telemetry by default; older history requires an Output destination configured in advance.
Article Details
- Defense Focus
- Exporting and reviewing LimaCharlie telemetry for retrospective and ongoing investigation.
- Detection Methods
- Run LCQL searches over Insight telemetry, filtering by platform, event type, hostname, and time range.
- Use a dry run to estimate query cost before scanning data.
- Review exported event data in LogTotal.
- Data Sources
- LimaCharlie Insight data lake
- NEW_PROCESS events
- DNS_REQUEST events
- NETWORK_CONNECTIONS events
- Windows event logs (WEL)
- EVTX files collected as sensor artifacts
- Detections and audit logs when configured for export
- Rule Types
- LCQL queries
- Platforms
- LimaCharlie
- LogTotal
- Defensive Actions
- Use an API key with the permissions required to query Insight.
- Narrow queries by platform, event type, host, and time range; expand the scope only as needed.
- Use an Output to continuously send events to a destination such as S3, Google Cloud Storage, a SIEM, or a webhook.
- Use an Output destination for data older than Insight’s stated one-year retention period.
- Sanitize exported files before reviewing them in LogTotal.
Products
LimaCharlieInstall the LimaCharlie CLI (pip install limacharlie), log in with your organization ID and an API key, and run an LCQL query with limacharlie search run for the time range you need, with JSON output.LogTotalBelow is how to get events out, sanitize them, and investigate them for free in LogTotal.