Query (lmio-query)

The query skill teaches the agent how to author, validate, and execute analytical queries against LogMan.io log, event, and metric data.

Skill name	lmio-query
Library path	/AI/Skills/lmio-query/SKILL.md
Share	lmio (instance credentials and related files under /workspace/lmio/)
Depends on	lmio-rest-api for HTTP access to Chart and related APIs

What it is for

• Find, count, analyse, or visualize log data
• Security investigations (lateral movement, brute force, exfiltration, privilege escalation, …)
• Operational questions (event counts, top sources, timelines)
• Pattern detection across network, process, authentication, file, DNS, and related ECS fields

Typical user phrasing: “find X in the logs”, “how many Y in the last N hours”, “hunt for …”, “show me …”.

What it is not for

Need	Use instead
Alerts / tickets management	lmio-rest-api against lmio-alerts
Writing or publishing correlation rules	lmio-detection-engineer
Parser configuration	detection / parser workflows, not this skill
Pure product documentation	lmio-knowledge

Prerequisites

Before querying, the agent needs:

1. Instance name — loads credentials from /workspace/lmio/{instance}.json (BASE_URL + API_KEY)
2. Tenant on that instance — discover with the REST skill helper if unknown:

   python3 /library/AI/Skills/lmio-rest-api/scripts/lmio-api-get-tenants.py {instance}
   

Workflow (summary)

The skill encodes a repeatable loop:

1. List datasources — GET /api/lmio-chart/{tenant}/datasources

2. Pick a datasource — naming is <provider>.<name>:

   Provider	Technology	Use case
   es	Elasticsearch	Events and logs — start with es.events (data lake) almost always
   ix	InfluxDB	Time-series metrics (often system tenant)
   db	DuckDB	Aggregated ingest / EPS style metrics

3. Schema reconnaissance — GET /api/lmio-chart/{tenant}/fields/{datasource} (authoritative field list; ECS-oriented)

4. Author query YAML — aggregating or non-aggregating Chart query documents
5. Execute via the REST helpers / Chart API
6. Iterate — refine filters, time range, and aggregations from real results; verify fields are populated before relying on them

Detailed filter grammar, SP-Lang types, DuckDB analysis notes, and cheatsheets live as Library references under /AI/Skills/lmio-query/references/.

Design notes

• Prefer confirming schema and data presence over guessing field names
• Large results should land in /workspace files rather than flooding the conversation context
• Citations should name datasource, time range, and identifying event fields so analysts can reproduce the find in Discover / Chart