Execute PowerQuery commands against SentinelOne's Singularity Data Lake.
npx skills add https://github.com/Sentinel-One/ai-siem --skill powerquery
Please help me install this Agent Skill. Skill: powerquery Source: https://github.com/Sentinel-One/ai-siem/tree/main/plugins/s1-secops-skills/skills/powerquery Command: npx skills add https://github.com/Sentinel-One/ai-siem --skill powerquery
This Skill provides a comprehensive set of PowerQuery commands for querying and analyzing data from SentinelOne's Singularity Data Lake, enabling users to perform complex threat hunting, investigations, and detection rule development.
To create a PowerQuery that identifies PowerShell scripts executing with suspicious arguments, use the following command: event.type = 'Process Creation' src.process.name = 'powershell.exe' src.process.cmdline matches '.*\s(.*?\.exe).*' | group count() by dst.ip.address
High-intent search queries and answers about installing and using this skill.
You can query SentinelOne's Singularity Data Lake by executing PowerQuery commands to perform advanced data filtering, transformation, and threat hunting. This allows deep visibility into events for identifying malicious activity like suspicious PowerShell executions.
Yes, PowerQuery provides the necessary commands to create effective detection rules within SentinelOne. You can develop queries to match specific threat patterns and process creation events, enabling automated detection and response.
To find destination IP addresses from PowerShell executions, use a PowerQuery filtering for event.type = 'Process Creation' and src.process.name = 'powershell.exe'. You can then group the results by dst.ip.address to aggregate the network connections.
Yes, running PowerQuery commands requires knowledge of both the PowerQuery language and SentinelOne's data schema. Understanding fields like src.process.cmdline and dst.ip.address is essential for accurate event search and threat hunting.
The best way to analyze process creation events is using PowerQuery to filter by event.type = 'Process Creation'. This allows you to investigate process command lines, group data by specific fields, and identify suspicious script arguments.
PowerQuery is specifically designed for querying the Singularity Data Lake, meaning its use is limited to the SentinelOne ecosystem. Effective investigations depend on your knowledge of the PowerQuery syntax and the available data schema.
wyre-technologyExecute PowerQuery language queries against SentinelOne Singularity Data Lake for threat hunting.
stephendolanImplement Windows C++ input batching, threading, and COM resource management with Win32 APIs.
vinnie357Manage and execute Dagu workflows via REST API endpoints.
wyre-technologyQuery Proofpoint TAP threat intelligence and SIEM event data for security analysis.
