Follow Install the LimaCharlie CLI (pip install limacharlie), log in with your organization ID and an API key, and run an LCQL query with limacharlie search run for the time range you need, with JSON output. Events come back in LimaCharlie’s {routing, event} structure. For continuous, bulk export, configure an Output to S3, Google Cloud Storage or another destination.
LimaCharlie keeps a year of telemetry in its Insight data lake by default, which makes after-the-fact investigation unusually practical. Prime Core has more than 24,000 unique detection rules, mapped to 676 MITRE ATT&CK techniques. Below is how to get events out, sanitize them, and investigate them for free in LogTotal.
Before you start
An API key and your OID. Both are in the web app under Access Management → REST API. Give the key the permissions needed to query Insight.
Queries cost money. LCQL queries are billed by the data they scan. Dry runs give you an estimate first. Narrow by platform, event type and host before you widen the time range.
Know the event types. LimaCharlie names events by type: NEW_PROCESS, DNS_REQUEST, NETWORK_CONNECTIONS, WEL (Windows event logs) and so on. Pick the ones that matter for your question.
Export with the CLI
pip install limacharlie
limacharlie auth login # asks for your OID and API key
limacharlie search run \
--query 'plat == windows | NEW_PROCESS DNS_REQUEST | routing/hostname == "ws-042"' \
--start $(date -d '2026-10-19T00:00:00Z' +%s) \
--end $(date -d '2026-10-20T00:00:00Z' +%s) \
--oid <oid> --output json > lc_ws042_1019.json
An LCQL query has parts separated by pipes: a sensor selector (plat == windows), the event types, a filter, and optionally a projection of fields. If the output is an array, flatten it with jq -c ‘.[]’.
The CLI can also generate an LCQL query from a plain-language description (limacharlie ai generate-query), which helps when you don’t remember the field paths.
Bulk: Outputs
For ongoing export, add an Output in the web app that sends events (and detections or audit logs, if you want them) to S3, Google Cloud Storage, a SIEM or a webhook. Outputs send data from the moment they’re created. For history, query Insight as above.
Upload, sanitize and review in LogTotal
- Upload. Open logtotal.com and drop in the file.
- Sanitize.
- Review.
When it goes wrong
| Symptom | Likely cause | Fix |
|---|---|---|
| Authentication errors | Wrong OID or key, or missing permissions | Recreate the key with query permissions |
| Query is slow or expensive | Too wide: all events, all sensors | Add a sensor selector and event types |
| No results | Hostname in the wrong field, or wrong event type | Check field paths with a small query first |
| Nothing older than a year | Insight retention | Use your Output destination for older data |
FAQ
Can LimaCharlie collect EVTX files from an endpoint?
Yes, as artifacts collected from the sensor, and Windows event logs also stream in as WEL events.
Is there an older interactive query mode?
Yes. Earlier CLI versions had an interactive limacharlie query shell with set_output and set_format json. The search run command is the scriptable route.
