skills.rest
pmoses-s1
pmoses-s1COMMUNITY
Explore all skills by this author →
GitHub

sentinelone-powerquery

Automates generation of C# P/Invoke wrappers for Windows APIs from a YAML spec.

Updated Aug 23, 2026
Search Tags:#mcp#sdl#threat-hunting#investigations#powerquery#lrq
One-click install
npx skills add https://github.com/pmoses-s1/claude-skills --skill sentinelone-powerquery
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: sentinelone-powerquery
Source: https://github.com/pmoses-s1/claude-skills/tree/main/sentinelone-powerquery
Command: npx skills add https://github.com/pmoses-s1/claude-skills --skill sentinelone-powerquery

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve?

The SentinelOne PowerQuery skill empowers security analysts to author, debug, optimize, explain, and run PowerQuery queries against SentinelOne SDL data to accelerate threat hunting, investigations, and detection-rule workflows.

Core Features & Use Cases

  • Write, validate, and execute PowerQuery bodies against confirmed API schemas with guidance for LRQ execution and MCP fallback.
  • Debug, explain, and refine queries for threat hunting, incident response, dashboards, and STAR/Custom Detection rule development.
  • Leverage reference materials and examples to accelerate production-ready PQs across tenants and data sources.

Quick Start

Draft a PowerQuery body and run it against your tenant to retrieve a structured table of events.

Frequently Asked Questions about sentinelone-powerquery

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I write and run SentinelOne PowerQuery for threat hunting?▼

To run SentinelOne PowerQuery for threat hunting, you draft a query body and execute it against your tenant to retrieve a structured table of EDR/XDR events, following enforced syntax rules and schema discovery.

What is an LRQ execution in SentinelOne and what payload does it require?▼

LRQ execution in SentinelOne is a PowerQuery run method that requires specific parameters including startTime, endTime, a Bearer token, and the pq payload to successfully retrieve SDL data.

Can I use an MCP proxy with SentinelOne PowerQuery?▼

Yes, the SentinelOne PowerQuery workflow supports MCP proxy integration and provides fallback guidance to help you execute queries and manage data retrieval across tenants.

How do I validate PowerQuery syntax against confirmed SentinelOne API schemas?▼

You validate PowerQuery syntax by leveraging built-in reference materials and examples that enforce syntax rules against confirmed API schemas, ensuring your production-ready queries run without errors.

What are the limitations when running SentinelOne PowerQuery for investigations?▼

Limitations include strict PowerQuery syntax enforcement and mandatory LRQ execution requirements; without proper startTime, endTime, Bearer token, and pq payload parameters, the query against SDL data will fail.

Related Skills

Explore More Data & Analytics Skills→
Sentinel-OneSentinel-One
59

sdl-solutions

Orchestrate deployment and configuration of multiple SentinelOne SDL solutions.

Official
Advanced
OpenTideHQOpenTideHQ
4

sentinelone-singularity

Author SentinelOne Singularity detection content across STAR, DVQL, and SDL analytics.

Official
Advanced
Sentinel-OneSentinel-One
59

powerquery

Execute PowerQuery commands against SentinelOne's Singularity Data Lake.

Official
Advanced
audibleblinkaudibleblink
4

kql-mde-xdr

Write and optimize KQL queries for MDE, Sentinel, and Defender XDR.

Community
Advanced