SentinelOne PowerQuery

Authors and runs SentinelOne PowerQuery threat-hunting and detection-rule queries correctly

Funciona con configuración ★ 9.6/10

Qué hace

Encodes the exact SentinelOne PowerQuery (PQ) grammar, a table of banned/hallucinated function names with their real replacements, and 19 hard-won correctness rules (escaping, join/subquery placement, null handling) for Deep Visibility, STAR detection rules, and SDL dashboards. Triggers on PowerQuery/PQ/S1QL/Deep Visibility/STAR-rule requests and casual threat-hunt phrasing, and explicitly declines Microsoft Power Query and Splunk SPL requests.

Informe de la prueba

Skill folder is fully self-contained (10 reference files + 4 example files, all verified present via raw GitHub fetch), but every query still needs a live paid SentinelOne Singularity Data Lake tenant plus an API JWT to actually execute — there's no way to run one against a real dataset in this environment, so correctness was verified against the skill's own documented rules, not a live 200 response.

Probado el: 2026-07-15 · Claude Code 2.x (agent harness)

Instalación

git clone https://github.com/pmoses-s1/claude-skills
cd claude-skills
mkdir -p ~/.claude/skills
cp -r sentinelone-powerquery ~/.claude/skills/sentinelone-powerquery

Comandos y prompts de ejemplo

/sentinelone-powerqueryAuthors and runs SentinelOne PowerQuery threat-hunting and detection-rule queries correctly

Los skills se activan con peticiones en lenguaje natural, sin comandos que memorizar. Tras instalarlo, prompts como estos lo activan (en inglés):

Write a PowerQuery to find PowerShell processes reaching out to the internet
Why is my Deep Visibility query returning matchCount=0 in SentinelOne?
Write a STAR custom detection rule body for suspicious lsass access

Informe completo →