skills.rest
pmoses-s1
pmoses-s1COMMUNITY
Explore all skills by this author →
GitHub

sentinelone-sdl-log-parser

Build and validate deployable SDL parsers from raw log samples.

Updated Aug 23, 2026
Search Tags:#validation#parsing#mapping#sdl#ocsf#log-parser
One-click install
npx skills add https://github.com/pmoses-s1/claude-skills --skill sentinelone-sdl-log-parser
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: sentinelone-sdl-log-parser
Source: https://github.com/pmoses-s1/claude-skills/tree/main/sentinelone-sdl-log-parser
Command: npx skills add https://github.com/pmoses-s1/claude-skills --skill sentinelone-sdl-log-parser

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve?

This skill turns raw log samples into deployable SDL parsers, enabling end-to-end validation and deployment of parser definitions in the SDL tenant.

Core Features & Use Cases

  • Author, edit, and validate SentinelOne SDL log parsers from augmented-JSON definitions that live under /logParsers.
  • Validate end-to-end by deploying the parser, ingesting a sample, and querying parsed fields to confirm correct extraction.
  • Support multi-format SDL parsers with per-format attributes and mappings to produce OCSF-conformant events for hunts, dashboards, and PowerQuery queries.

Quick Start

Create a draft SDL parser JSON under /logParsers/<name>, deploy it with the put_file flow, ingest a sample with upload_logs, and verify results with a power query.

Frequently Asked Questions about sentinelone-sdl-log-parser

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I create a SentinelOne SDL log parser from raw log samples?▼

To create an SDL log parser, draft the parser definition in JSON under /logParsers, deploy it using put_file, ingest a sample with upload_logs, and verify extraction with a power query.

What is OCSF field mapping in SDL log parsers?▼

OCSF field mapping involves translating extracted log data into OCSF-conformant events using references/ocsf-schema-documentation.md, enabling the parsed logs to be used in hunts, dashboards, and PowerQuery queries.

How do I validate an SDL parser end-to-end?▼

Validate an SDL parser end-to-end by deploying the JSON definition with put_file, ingesting a raw log sample via upload_logs, and running a power query to confirm correct field extraction.

Can I build multi-format SDL log parsers?▼

Yes, you can build multi-format SDL log parsers by defining per-format attributes and mappings within the augmented-JSON definition to produce OCSF-conformant events.

What are the required attributes for an SDL parser definition?▼

SDL parser definitions require specific frontmatter attributes defined in a SKILL.md file, which are enforced during the JSON parsing and validation process to ensure deployability.

Related Skills

Explore More Data & Analytics Skills→
Sentinel-OneSentinel-One
59

sdl-solutions

Orchestrate deployment and configuration of multiple SentinelOne SDL solutions.

Official
Advanced
Sentinel-OneSentinel-One
59

soc-investigator

Automate DFIR investigations from SentinelOne alerts with configurable modes.

Official
Advanced
Sentinel-OneSentinel-One
59

sdl-api

Manage and query SentinelOne Singularity Data Lake API data and configurations.

Official
Advanced
Sentinel-OneSentinel-One
59

sdl-log-parser

Create and validate SentinelOne Singularity Data Lake log parsers from raw log samples.

Official
Advanced