SentinelOne PowerQuery

Authors and runs SentinelOne PowerQuery threat-hunting and detection-rule queries correctly

Fonctionne avec configuration ★ 9.6/10

Ce que fait

Encodes the exact SentinelOne PowerQuery (PQ) grammar, a table of banned/hallucinated function names with their real replacements, and 19 hard-won correctness rules (escaping, join/subquery placement, null handling) for Deep Visibility, STAR detection rules, and SDL dashboards. Triggers on PowerQuery/PQ/S1QL/Deep Visibility/STAR-rule requests and casual threat-hunt phrasing, and explicitly declines Microsoft Power Query and Splunk SPL requests.

Rapport de test

Skill folder is fully self-contained (10 reference files + 4 example files, all verified present via raw GitHub fetch), but every query still needs a live paid SentinelOne Singularity Data Lake tenant plus an API JWT to actually execute — there's no way to run one against a real dataset in this environment, so correctness was verified against the skill's own documented rules, not a live 200 response.

Testé le: 2026-07-15 · Claude Code 2.x (agent harness)

Installation

git clone https://github.com/pmoses-s1/claude-skills
cd claude-skills
mkdir -p ~/.claude/skills
cp -r sentinelone-powerquery ~/.claude/skills/sentinelone-powerquery

Commandes et exemples de prompts

/sentinelone-powerqueryAuthors and runs SentinelOne PowerQuery threat-hunting and detection-rule queries correctly

Les skills se déclenchent sur des demandes en langage courant — aucune commande à retenir. Après installation, des prompts comme ceux-ci l'activent (en anglais) :

Write a PowerQuery to find PowerShell processes reaching out to the internet
Why is my Deep Visibility query returning matchCount=0 in SentinelOne?
Write a STAR custom detection rule body for suspicious lsass access

Rapport complet →