lookup-files
Manage Falcon Next-Gen SIEM lookup files (CSV/JSON/TXT) for CQL match() queries. TRIGGER when user asks to create, list, update, or delete lookup files, or needs help with CQL match() function. DO NOT TRIGGER for Fusion workflows, action discovery, or workflow deployment — use the workflows/authoring/deployment skills.
- License
- MIT
- Compatibility
- Claude Code >=1.0
Pinned to revision 4e8964e24a5a, so it is the text this page describes rather than whatever the author pushed since.
Pre-approved tools experimental
Experimental field. Support varies between clients, so this list is what the author declared, not what your client will enforce.
- Bash(cd *)
- Bash(scripts/python.sh:*)
Files
- skills/lookup-files/SKILL.md
- skills/lookup-files/LICENSE
- skills/lookup-files/assets/example-ip-blocklist.csv
- skills/lookup-files/assets/example-user-risk.csv
- skills/lookup-files/common/scripts/auth.py
- skills/lookup-files/references/cql-match-function.md
- skills/lookup-files/references/lookup-file-formats.md
- skills/lookup-files/scripts/create_lookup.py
- skills/lookup-files/scripts/delete_lookup.py
- skills/lookup-files/scripts/get_lookup.py
- skills/lookup-files/scripts/list_lookups.py
- skills/lookup-files/scripts/python.sh
- skills/lookup-files/scripts/update_lookup.py
- skills/lookup-files/scripts/verify_lookup.py
Every link opens the file at its source, pinned to the revision this page describes.