powerquery

What problem does it solve?

This Skill provides a comprehensive set of PowerQuery commands for querying and analyzing data from SentinelOne's Singularity Data Lake, enabling users to perform complex threat hunting, investigations, and detection rule development.

Core Features & Use Cases

• PowerQuery Language Support: Offers a full range of PowerQuery commands for data filtering, transformation, and analysis.
• Threat Hunting: Facilitates the creation of PowerQueries for deep visibility, event search, and threat hunting tasks.
• Investigations: Enables the development of PowerQueries for detailed analysis and reporting.
• Detection Rule Development: Provides the necessary PowerQuery commands to create effective detection rules.
• Use Case: For example, a user can create a PowerQuery to search for all events where a PowerShell script has executed and then identify the destination IP addresses.

Quick Start

To create a PowerQuery that identifies PowerShell scripts executing with suspicious arguments, use the following command: event.type = 'Process Creation' src.process.name = 'powershell.exe' src.process.cmdline matches '.*\s(.*?\.exe).*' | group count() by dst.ip.address