SentinelOne PowerQuery
Authors and runs SentinelOne PowerQuery threat-hunting and detection-rule queries correctly
Test report
- Verdict
- Works with setup
- Score
- Tested
- Jul 15, 2026
- Environment
- Claude Code 2.x (agent harness)
- Upstream re-checked
- Jul 25, 2026 · da61fd6
⚠ This skill is no longer available upstream. Our re-check on Aug 10, 2026 couldn't find it any more (repo unreachable/deleted). The test below is what we measured on Jul 15, 2026 and we're leaving it up as a record — but there is nothing left to install, so we've removed the command.
Skill folder is fully self-contained (10 reference files + 4 example files, all verified present via raw GitHub fetch), but every query still needs a live paid SentinelOne Singularity Data Lake tenant plus an API JWT to actually execute — there's no way to run one against a real dataset in this environment, so correctness was verified against the skill's own documented rules, not a live 200 response.
Scored on four weighted criteria — install, triggering, output vs. baseline, docs. How scoring works
- Installs cleanly 5/5
- Triggers reliably 5/5
- Output vs. baseline 9/10
- Docs & honesty 5/5
What SentinelOne PowerQuery does
Encodes the exact SentinelOne PowerQuery (PQ) grammar, a table of banned/hallucinated function names with their real replacements, and 19 hard-won correctness rules (escaping, join/subquery placement, null handling) for Deep Visibility, STAR detection rules, and SDL dashboards. Triggers on PowerQuery/PQ/S1QL/Deep Visibility/STAR-rule requests and casual threat-hunt phrasing, and explicitly declines Microsoft Power Query and Splunk SPL requests.
How to install SentinelOne PowerQuery
Nothing to install: the source repository no longer has this skill. If the author brings it back, our daily re-check will pick it up and the command will reappear here.
Commands — how to trigger SentinelOne PowerQuery
-
/sentinelone-powerqueryAuthors and runs SentinelOne PowerQuery threat-hunting and detection-rule queries correctly
It also activates on plain-language prompts like these:
-
Write a PowerQuery to find PowerShell processes reaching out to the internet -
Why is my Deep Visibility query returning matchCount=0 in SentinelOne? -
Write a STAR custom detection rule body for suspicious lsass access
Frequently asked questions
- Is the SentinelOne PowerQuery skill free?
- Yes. The skill itself is free from pmoses-s1/claude-skills. SkillProof publishes the install command and an independent test verdict at no cost.
- Does SentinelOne PowerQuery work with Claude Code?
- We tested it with Claude Code 2.x (agent harness) on Jul 15, 2026. Verdict: Works with setup. Skill folder is fully self-contained (10 reference files + 4 example files, all verified present via raw GitHub fetch), but every query still needs a live paid SentinelOne Singularity Data Lake tenant plus an API JWT to actually execute — there's no way to run one against a real dataset in this environment, so correctness was verified against the skill's own documented rules, not a live 200 response.
- What is the SentinelOne PowerQuery SkillProof Score?
- 9.6/10 — installs cleanly 5/5, triggers reliably 5/5, output vs. baseline 9/10, docs & honesty 5/5.
- How do I install SentinelOne PowerQuery?
- Copy the install command from this page, run it in your terminal, and restart Claude Code. Skills live in ~/.claude/skills/ (global) or .claude/skills/ inside a project.
- Can I use SentinelOne PowerQuery with Cursor, Copilot, Gemini CLI, Codex or other AI tools?
- The SKILL.md format is native to Claude (Claude Code, Desktop, claude.ai). The instructions inside adapt to other assistants: Cursor rules, GitHub Copilot instructions, Windsurf rules, Custom GPTs, AGENTS.md for OpenAI Codex, and GEMINI.md for Google Gemini CLI — our conversion guides cover each, and the free converter on the tools page does the wrapping for you.