SkillProof tested Claude skills

SentinelOne PowerQuery

Authors and runs SentinelOne PowerQuery threat-hunting and detection-rule queries correctly

od pmoses-s1 · pmoses-s1/claude-skills

Funguje s nastavením ★ 9.6/10

SentinelOne PowerQuery — Authors and runs SentinelOne PowerQuery threat-hunting and detection-rule queries correctly

Co umí

Encodes the exact SentinelOne PowerQuery (PQ) grammar, a table of banned/hallucinated function names with their real replacements, and 19 hard-won correctness rules (escaping, join/subquery placement, null handling) for Deep Visibility, STAR detection rules, and SDL dashboards. Triggers on PowerQuery/PQ/S1QL/Deep Visibility/STAR-rule requests and casual threat-hunt phrasing, and explicitly declines Microsoft Power Query and Splunk SPL requests.

Testovací report

Skill folder is fully self-contained (10 reference files + 4 example files, all verified present via raw GitHub fetch), but every query still needs a live paid SentinelOne Singularity Data Lake tenant plus an API JWT to actually execute — there's no way to run one against a real dataset in this environment, so correctness was verified against the skill's own documented rules, not a live 200 response.

Testováno: 2026-07-15 · Claude Code 2.x (agent harness)

Instalace

git clone https://github.com/pmoses-s1/claude-skills
cd claude-skills
mkdir -p ~/.claude/skills
cp -r sentinelone-powerquery ~/.claude/skills/sentinelone-powerquery

Příkazy a ukázkové prompty

  • /sentinelone-powerqueryAuthors and runs SentinelOne PowerQuery threat-hunting and detection-rule queries correctly

Skilly se spouštějí běžnými požadavky — žádné příkazy k zapamatování. Po instalaci ho aktivují prompty jako tyto (anglicky):

  • Write a PowerQuery to find PowerShell processes reaching out to the internet
  • Why is my Deep Visibility query returning matchCount=0 in SentinelOne?
  • Write a STAR custom detection rule body for suspicious lsass access

Kompletní testovací report (anglicky) →