Search everything...

Stats

Actions

Available In

s1-secops-skills

Name: s1-secops-skills
Author: sentinel-one

By Sentinel-One

Generate Hyperautomation workflows, author and run PowerQuery threat hunting queries, interact with the Singularity Data Lake API, and deploy packaged SDL solutions—all from a single Claude conversation for SentinelOne SecOps environments.

npx claudepluginhub sentinel-one/ai-siem --plugin s1-secops-skills

Popularity

Stars

Top 10%

Med: 0·Avg: 281

Installs

Med: 0·Avg: 1

What's Inside

Skills4

hyperautomation

/hyperautomation

Use this skill whenever a user wants to create, design, build, generate, write, or export a SentinelOne Hyperautomation workflow in JSON format. Triggers include: any mention of "Hyperautomation", "workflow", "automation", "SOAR", "playbook", "alert response", "trigger", "scheduled workflow", "webhook workflow", or any request to automate a SentinelOne-related security task. Also triggers when the user asks to import, export, test, validate, or submit a workflow to a SentinelOne console via API. Always use this skill for any task involving SentinelOne workflow JSON — even if phrased casually (e.g., "build me a thing that disables a user when an alert fires"). When in doubt about whether this skill applies, use it.

powerquery

/powerquery

Use any time the user wants to author, debug, optimize, explain, or run a SentinelOne PowerQuery (PQ) — Deep Visibility / Event Search queries, XDR/EDR threat hunting, investigations, STAR / Custom Detection rule bodies, PowerQuery Alerts, or Singularity Data Lake dashboard panels. Trigger on PowerQuery, PQ, pq, query, Event Search, Deep Visibility, S1QL, SDL, STAR rule, Custom Detection rule, PowerQuery Alert; on queries using fields like `event.type`, `src.process.*`, `tgt.file.*`, `indicator.*`, `agent.uuid`; on pipes like `| group`, `| filter`, `| let`, `| join`, `| parse`, `| columns`, `| compare`, `| top`, `| union`, `| lookup`, `| savelookup`, `| dataset`. Also trigger when asked to hunt a TTP, IOC, behavior, or alert pattern on a SentinelOne tenant — even casually ("find powershell reaching out to the internet", "write a detection for lsass access"). Explicitly NOT Microsoft Power Query / M / Excel and NOT Splunk SPL — this is SentinelOne's pipeline query language for security telemetry.

sdl-api

/sdl-api

Use whenever the user wants to read data and manage configuration through the SentinelOne Singularity Data Lake (SDL) API — run queries or manage configuration files (parsers, dashboards, alerts, lookups, datatables) on a Scalyr/SDL/XDR tenant. Trigger on "SDL", "SDL API", "Singularity Data Lake", "Scalyr", "DataSet", "xdr.us1.sentinelone.net" or any "*.sentinelone.net/api/*" URL, and on the method names "query", "powerQuery", "facetQuery", "timeseriesQuery", "numericQuery", "getFile", "putFile", "listFiles". Also trigger on tasks like "run a powerQuery", "list configuration files", "edit my parser via API", "deploy a dashboard JSON", "compute the rate of failures over time", or anything involving Log Read / Configuration Read / Configuration Write SDL keys, Bearer-token auth, or the S1-Scope header. Wraps every SDL method with a Python client and CLI.

sdl-solutions

/sdl-solutions

Deploy packaged, repeatable SentinelOne Singularity Data Lake (SDL) solutions into a site from one prompt. Use when the user wants to onboard, deploy, or roll out a whole SDL solution. Catalog: (1) data source onboarding (raw to OCSF, enrichment, dashboard, MITRE detections, threat response); (2) asset enrichment from the Asset Inventory; (3) UEBA behavioral anomaly detection (per action/principal z-score: SPIKE/DROP/SILENT/NEW); (4) per-device ingest health monitoring (7-day baseline: spike/drop/lag/silence/parser drift); (5) scheduled detection exclusions, suppress known-good noise in a scheduled PowerQuery detection over a third-party source via a CSV exclusion list (assets by IP/CIDR/host or custom domains/users/values) and a lookup anti-join, with an effectiveness dashboard. Triggers: 'onboard a new source', 'deploy UEBA/asset enrichment/ingest health', 'add a detection exclusion for a source', 'exclude these assets/domains from a detection'. NOT for one-off queries or standalone parser authoring.

Hooks1

Event Hooks

1 hook across 1 event

Stats

Version1.2.2

ReleasedJun 23, 2026

LanguageLua

Stars51

Forks29

MaintenanceExcellent

LicenseAGPL-3.0

Last CommitJun 22, 2026

AddedJun 23, 2026

Actions

View on GitHub View README Plugin Marketplace JSON Homepage

Own this plugin?

Verify ownership to unlock analytics, metadata editing, and a verified badge. GitHub access is read-only (username + org membership).

Available In

sentinelone51

README

AI-SIEM Repository – A SentinelOne GitHub Forge Project

A community‑driven, SentinelOne‑assisted library of parsers, dashboards, detections & response playbooks that supercharge the Singularity Platform.

Important Note

Sentinel-One AI-SIEM repository is a community-driven, open source project designed to streamline the deployment and use of the SentinelOne's AI SIEM. While not a formal SentinelOne product, Sentinel-One AI-SIEM repository is maintained by SentinelOne and supported in partnership with the open source developer community.

Why this repository exists

Unite scattered content and eliminate “hunt‑the‑snippet” time for engineers and customers.
Enforce automated quality gates so every artifact is production‑ready.
Foster an open ecosystem where field teams, partners, and customers co‑create knowledge objects.

Repository layout

ai-siem/                # AI SIEM core structure (260+ components)
  ├── dashboards/      # Visualizations (79 dashboards with metadata)
  │   └── community/   # Community-contributed dashboards
  ├── detections/      # Detection rules (8 detections with metadata)
  │   └── community/   # Community-contributed detection rules
  ├── monitors/        # Python monitoring scripts for Dataset Agent (log_gen, maxmind, powerquery)
  ├── pipelines/       # Observo pipeline templates
  │   ├── push/        # Vendor pushes to us (syslog/CEF/LEEF/KV or direct HEC)
  │   │   ├── syslog/<vendor>/<product>/
  │   │   └── hec/<vendor>/<product>/
  │   ├── pull/        # We fetch from the vendor (REST API or object store)
  │   │   ├── api/<vendor>/<product>/
  │   │   └── object_store/<vendor>/<product>/
  │   └── community/
  │       └── transform_ocsf/<vendor>/<product>/  # OCSF normalization overlays
  ├── parsers/         # Parsing logic and configurations (165 parsers)
  │   ├── community/   # 148 community parsers (*.conf + metadata)
  │   └── sentinelone/ # 17 official marketplace parsers (*.conf + metadata)
  ├── workflows/       # Automated playbooks and responses (3 workflows with metadata)
  ├── plugins/         # Claude plugins (skills bundled for Cowork / Claude Code)
  │   └── s1-secops-skills/  # 7 SentinelOne SecOps skills + built .plugin/.skill bundles
  └── mcp/             # SentinelOne MCP server (Node.js) + container build

Quick start

Clone the repo and select the folder that matches your use‑case.
Import dashboards (*.conf) or rules (*.conf) into your Singularity console.
Choose between community parsers or official SentinelOne marketplace parsers.
Deploy parsers using the included metadata.yaml for proper configuration.
(Optional) run make install or make validate to lint and prep local changes.

Contribution guide

Fork the repo and create a feature branch.
Name files vendor-usecase-vX.Y.<ext> (e.g., zscaler_http_access-v1.0.s1ql) and add a matching metadata.yaml.
Include or update sample logs under tests/fixtures.
Open a Pull Request – CI will run secret scanning and CodeReview.
At least one owner review is required before merge.

Automation & quality gates

Stage	What it does
Security	Secret scanning & CodeQL
Release	Semantic‑release tags `vX.Y.Z` and publishes artifacts to GitHub Releases & S3

Community recognition

Quarterly awards for Top Contributor, Most Interesting Use‑Case, and Best Dashboard keep momentum high. All merged PRs count toward the public leaderboard—watch the PartnerOne newsletter for shout‑outs!

Roadmap & KPIs

MVP v1.0 public launch at OneCon.
≥ 200 GitHub ⭐ stars, 30 external PRs, and 40 % tenant adoption within the first 12 months.
Continuous sprint cadence with KPI reviews every quarter.

License

Released under the GNU Affero General Public License v3.0 (AGPL-3.0) – ensuring that all modifications and network use remain open source. See the LICENSE file for details.

Monitors Installation Guide

Dataset Agent Integration

The monitors directory contains Python scripts for use with the Dataset Agent:

log_gen.py - Generate test logs for various vendor formats (Cisco, Windows DNS)
maxmind.py - MaxMind GeoIP enrichment for IP addresses
powerquerymonitor.py - PowerQuery monitoring capabilities

Installation Steps

Copy monitor files to Dataset Agent directory:

cp monitors/*.py /usr/share/scalyr-agent-2/py/scalyr_agent/builtin_monitors/

View full README on GitHub

s1-secops-skills

Popularity

What's Inside

Confidence

README

AI-SIEM Repository – A SentinelOne GitHub Forge Project

Important Note

Why this repository exists

Repository layout

Quick start

Contribution guide

Automation & quality gates

Community recognition

Roadmap & KPIs

License

Monitors Installation Guide

Dataset Agent Integration

Installation Steps

Similar Plugins

sentinelone-skills

crowdstrike-cql-patterns

lc-essentials

security-operations

AI-SIEM Repository – A SentinelOne GitHub Forge Project

Important Note

Why this repository exists

Repository layout

Quick start

Contribution guide

Automation & quality gates

Community recognition

Roadmap & KPIs

License

Monitors Installation Guide

Dataset Agent Integration

Installation Steps

Popularity

Health & Quality

Similar Plugins

sentinelone-skills

crowdstrike-cql-patterns

lc-essentials

security-operations

asp

security-incident-responder

AI-SIEM Repository – A SentinelOne GitHub Forge Project

AI-SIEM Repository – A SentinelOne GitHub Forge Project