Sentinel-OneOfficial·8 Agent Skills Included

ai-siem

SentinelOne SIEM parsers, dashboards, detections, and SOC automation

Builds and deploys SentinelOne Singularity Data Lake content: log parsers, dashboards, detection rules, and response playbooks. Runs PowerQuery threat hunts, alert triage, DFIR investigations, and Hyperautomation workflows directly against a live tenant. Eliminates manual parser writing, schema guessing, and repetitive console clicking for security operations teams.

59|30

↗

npx skills add Sentinel-One/ai-siem --all -g -y

Available:

Instructs the agent to act as a principal SOC analyst, mandating cached schema discovery, evidence-based verdicts, threat-intel enrichment, and strict confidence rules before running any SentinelOne query or investigation.

All Skills in This Repository (8)

Pure Emerald Level Indicators

📦 In Repo

Sentinel-One

powerquery

Execute PowerQuery commands against SentinelOne's Singularity Data Lake.

sdl-dashboard

Creates, edits, and deploys Singularity Data Lake dashboards with JSON and Python validation.

mgmt-console-api

Query and manage SentinelOne console resources via REST and GraphQL APIs.

sdl-api

Manage and query SentinelOne Singularity Data Lake API data and configurations.

sdl-log-parser

Create and validate SentinelOne Singularity Data Lake log parsers from raw log samples.

hyperautomation

Create and manage SentinelOne Hyperautomation workflows via the Hyperautomation API.

soc-investigator

Automate DFIR investigations from SentinelOne alerts with configurable modes.

sdl-solutions

Orchestrate deployment and configuration of multiple SentinelOne SDL solutions.

Official

Advanced

Frequently Asked Questions

FAQPage Schema

How to install ai-siem?▼

Run `npx skills add Sentinel-One/ai-siem --all -g -y` in your terminal to install all eight SecOps skills globally.

What does the ai-siem repository include?▼

It ships 165+ log parsers, 79 dashboards, detection rules, Observo pipeline templates, and eight skills covering PowerQuery hunting, console API actions, dashboard building, parser authoring, and automated DFIR investigations.

Can it investigate SentinelOne alerts automatically?▼

Yes. The soc-investigator skill runs short, medium, or full forensic investigations with IOC enrichment, MITRE mapping, and a calibrated verdict report.

Do I need a SentinelOne tenant to use it?▼

Yes. You need a Singularity console URL and API token, which the skills read from a credentials.json file or environment variables.

Can I use it without writing code?▼

Yes. Describe the task in plain English, such as building a dashboard or triaging an alert, and the skills generate and deploy the required queries, parsers, and workflows.