SentinelOne PowerQuery
Authors and runs SentinelOne PowerQuery threat-hunting and detection-rule queries correctly
Działa po konfiguracji
Co robi ten skill
Encodes the exact SentinelOne PowerQuery (PQ) grammar, a table of banned/hallucinated function names with their real replacements, and 19 hard-won correctness rules (escaping, join/subquery placement, null handling) for Deep Visibility, STAR detection rules, and SDL dashboards. Triggers on PowerQuery/PQ/S1QL/Deep Visibility/STAR-rule requests and casual threat-hunt phrasing, and explicitly declines Microsoft Power Query and Splunk SPL requests.
Raport z testu
Skill folder is fully self-contained (10 reference files + 4 example files, all verified present via raw GitHub fetch), but every query still needs a live paid SentinelOne Singularity Data Lake tenant plus an API JWT to actually execute — there's no way to run one against a real dataset in this environment, so correctness was verified against the skill's own documented rules, not a live 200 response.
Testowano: 2026-07-15 · Claude Code 2.x (agent harness)
Instalacja
git clone https://github.com/pmoses-s1/claude-skills cd claude-skills mkdir -p ~/.claude/skills cp -r sentinelone-powerquery ~/.claude/skills/sentinelone-powerquery
Komendy i przykładowe prompty
/sentinelone-powerqueryAuthors and runs SentinelOne PowerQuery threat-hunting and detection-rule queries correctly
Skille uruchamiają się na zwykłe polecenia — bez komend do zapamiętania. Po instalacji aktywują go prompty takie jak te (po angielsku):
Write a PowerQuery to find PowerShell processes reaching out to the internetWhy is my Deep Visibility query returning matchCount=0 in SentinelOne?Write a STAR custom detection rule body for suspicious lsass access