# SentinelOne AI Analyst: Claude Skills

> Draft · awaiting review.

> Claude plugin with eight SentinelOne skills for threat hunting, alert triage, detections, dashboards, parsers and Hyperautomation workflows.

- Badge: `reach 3 · not run yet`
- Type: Plugin; tier: not run yet
- Tasks: Alert triage, Detection engineering; mission: Defensive; works with: Claude Code
- Source: https://github.com/Sentinel-One/ai-siem (plugins/s1-secops-skills), pinned to `b84fba9` (v_1_99_0), licence AGPL-3.0-only
- Last checked: 2026-10-21; next check: 2027-01-19; method v0.1, reach-v0.1

## At a glance

- **What it is:** A Claude plugin of SentinelOne SecOps skills for PowerQuery threat hunting and STAR/Custom Detection rules, the Management Console and Singularity Data Lake APIs, SDL dashboards, OCSF log parsing, Hyperautomation SOAR, autonomous DFIR alert investigation and 10 one-prompt SDL solutions. A plugin bundles skills, commands, hooks or MCP servers for one AI client.
- **Made for:** Lets Claude hunt threats, triage alerts, write detections, deploy dashboards, author parsers and build automation workflows for a SentinelOne tenant from natural language. +2 more
- **Runs:** Inside your AI client: its model follows the instructions and works with the client's own tools. Other modes: host-only Python scripts (on your machine, started by you); RBA demo console (on your machine, as a service with a network port). Listens only in an optional mode: The optional RBA demo console server.py binds its HTTP server to 127.0.0.1 on the port held in PORT (no sign-in).
- **Sends data to:** SentinelOne console and SDL APIs (always), Purple AI (if you turn it on), VirusTotal (by default), Shodan (if you turn it on), cve-search.org (CIRCL) (by default), Docker Hub (by default). Other connections not ruled out: read in the documentation and the cited code, not searched in full.
- **Can change things:** Changes, deletes, runs commands, sends data out, according to the capabilities read. Partly listed: Individual tool lists of s1-secops-mcp (35), purple-mcp and Shodan MCP; the ten sdl-solutions one by one; Windsurf workflow files; report builders (build_docx/pptx)
- **Needs:** A SentinelOne Management Console API token from a service user plus the console URL · Token role Viewer or higher for reads; IR Team or higher for response actions · Docker Desktop or Docker Engine, running · +5 more

Profile read at commit `b84fba9` on 2026-10-25; every fact cites a file and line at that commit.

## What it does

A Claude plugin of SentinelOne SecOps skills for PowerQuery threat hunting and STAR/Custom Detection rules, the Management Console and Singularity Data Lake APIs, SDL dashboards, OCSF log parsing, Hyperautomation SOAR, autonomous DFIR alert investigation and 10 one-prompt SDL solutions. (plugins/s1-secops-skills/.claude-plugin/plugin.json#L4)

Made for (the author says):

- Lets Claude hunt threats, triage alerts, write detections, deploy dashboards, author parsers and build automation workflows for a SentinelOne tenant from natural language. (plugins/s1-secops-skills/README.md#L3)
- CLAUDE.md sets a Principal SOC Analyst persona that runs the same enrichment, correlation and reasoning process on every alert. (plugins/s1-secops-skills/README.md#L92)
- The sdl-solutions skill deploys packaged Singularity Data Lake solutions into a site from one prompt. (plugins/s1-secops-skills/skills/sdl-solutions/SKILL.md#L4)

Documented uses:

- List open threats, triage UAM alerts, add analyst notes, change alert status or isolate an endpoint [Alert triage] (plugins/s1-secops-skills/README.md#L203)
- Scaffold a Git and CI pipeline that keeps detection rules as TOML and syncs them to the Custom Detection Rule API [Detection engineering] (plugins/s1-secops-skills/README.md#L396)
- Run a staged DFIR investigation of SentinelOne alerts in SHORT, MEDIUM or LONG mode [Incident response and forensics (DFIR)] (plugins/s1-secops-skills/skills/soc-investigator/SKILL.md#L19)
- Enrich IPs, domains, hashes and URLs through the configured threat-intel MCP before a verdict [Threat intel enrichment] (plugins/s1-secops-skills/README.md#L162)

Not for (the author says):

- The powerquery skill is not for Microsoft Power Query, M, Excel or Splunk SPL. (plugins/s1-secops-skills/skills/powerquery/SKILL.md#L5)
- sdl-solutions is not for one-off queries or standalone parser authoring. (plugins/s1-secops-skills/skills/sdl-solutions/SKILL.md#L4)
- The author says to enable write access only when authorised to change the tenant, and only for as long as needed. (plugins/s1-secops-skills/docs/read-only.md#L11)

## What it can do

| Group | What it covers | Effect | On by default |
|---|---|---|---|
| powerquery | powerquery_run runs every query that does not write; a query with | savelookup creates or overwrites a lookup table and is refused while s1-secops-mcp is read-only. (plugins/s1-secops-skills/docs/read-only.md#L63) | reads, changes | yes |
| mgmt-console-api | Management Console REST v2.1, UAM GraphQL and Purple AI calls through the s1_api_* and uam_* tools, including PUT, PATCH and DELETE. (plugins/s1-secops-skills/skills/mgmt-console-api/SKILL.md#L12) | reads, changes, deletes | yes |
| sdl-api | Singularity Data Lake API: event ingest, queries and configuration files such as parsers, dashboards and lookups. (plugins/s1-secops-skills/README.md#L81) | reads, changes | yes |
| sdl-dashboard | Designs, authors and deploys SDL dashboards with panels, tabs and parameters. (plugins/s1-secops-skills/README.md#L82) | reads, changes | yes |
| sdl-log-parser | Authors SDL log parsers and validates each one end to end: putFile, then HEC ingest with the parser applied, then a query. (plugins/s1-secops-skills/skills/sdl-log-parser/SKILL.md#L4) | reads, changes | yes |
| hyperautomation | ha_* tools list, get, import, export and delete Hyperautomation workflows; s1_api_post, s1_api_put and s1_api_delete publish, activate, deactivate and run them now. (plugins/s1-secops-skills/skills/hyperautomation/SKILL.md#L35) | reads, changes, deletes | yes |
| sdl-solutions | Umbrella skill for ten packaged SDL solutions (onboarding, enrichment, UEBA, ingest health, exclusions, RBA, DaC, noise reduction, MITRE mapping, query slicing). (plugins/s1-secops-skills/README.md#L85) | reads, changes | yes |
| soc-investigator | Sends external IPs, domains, URLs and hashes to the configured threat-intel MCP before a verdict, skipped when the user asks for SentinelOne-only analysis or none is configured. (plugins/s1-secops-skills/skills/soc-investigator/SKILL.md#L31) | reads, sends data out | yes |
| CLAUDE.md persona | Session protocol that enumerates SDL sources, triages alerts and writes s1_sdl_schema_cache.json into the project root. (plugins/s1-secops-skills/CLAUDE.md#L39) | reads, changes | yes |
| host-only Python scripts | Python clients under scripts/ (S1Client, pq.py, unified_alerts.py and others) that Claude Code or a terminal runs on the host. (plugins/s1-secops-skills/skills/mgmt-console-api/SKILL.md#L14) | reads, changes, runs commands | no |

Partly listed: Individual tool lists of s1-secops-mcp (35), purple-mcp and Shodan MCP; the ten sdl-solutions one by one; Windsurf workflow files; report builders (build_docx/pptx)

## How it runs

The s1-secops-mcp server runs on the user's machine as a local Node.js process or as the Docker image started by the host launcher, over stdio and outside the Cowork sandbox; it carries all SentinelOne API calls and reads credentials from environment variables, then the OS keychain. (plugins/s1-secops-skills/docs/architecture.md#L60)

- Starts: Inside your AI client: its model follows the instructions and works with the client's own tools. Skills are procedural knowledge Claude reads; they do not execute API calls directly when loaded but tell Claude how to use the MCP tools. (plugins/s1-secops-skills/docs/architecture.md#L118)
- Can also run: On your machine, started by you (host-only Python scripts). Python clients in the skills run from Claude Code or a terminal on the user's machine. (plugins/s1-secops-skills/docs/credentials.md#L239)
- Can also run: On your machine, as a service with a network port (RBA demo console). An optional local, browser-based console for demoing Risk-Based Alerting. (plugins/s1-secops-skills/skills/sdl-solutions/assets/rba_console/README.md#L3)
- Your AI client: **CLAUDE.md persona**: CLAUDE.md sets the Principal SOC Analyst persona, session protocol and verdict rules. (plugins/s1-secops-skills/docs/architecture.md#L48)
- Your AI client: **Skills (8 SKILL.md)**: Eight SKILL.md files that Claude reads when a request triggers them. (plugins/s1-secops-skills/docs/architecture.md#L111)
- Your machine: **s1-secops-mcp-launch launcher**: Host launcher script that reads the OS keychain and passes secrets to the container over stdin. (plugins/s1-secops-skills/README.md#L431)
- Container on your machine: **sentinelone/secops-mcps MCP servers**: One Docker image, sentinelone/secops-mcps, ships s1-secops-mcp, purple-mcp, virustotal-mcp and the optional shodan-mcp, version-locked together. (plugins/s1-secops-skills/docs/installation.md#L5)
- Outside your machine: **SentinelOne tenant APIs**: SentinelOne endpoints at *.sentinelone.net, which the skills reach through the MCP servers. (plugins/s1-secops-skills/README.md#L67)
- Outside your machine: **VirusTotal / Shodan**: Third-party services VirusTotal and Shodan that receive enrichment queries. (plugins/s1-secops-skills/THIRD_PARTY_NOTICES.md#L15)
- Listens: The optional RBA demo console server.py binds its HTTP server to 127.0.0.1 on the port held in PORT.: this machine only (loopback), no sign-in, in an optional mode (plugins/s1-secops-skills/skills/sdl-solutions/assets/rba_console/server.py#L217)
- Sends data to SentinelOne console and SDL APIs (vendor API, always): API calls with the console token go from the user's machine to the SentinelOne tenant. (plugins/s1-secops-skills/docs/architecture.md#L153)
- Sends data to Purple AI (vendor API, if you turn it on): purple_ai sends a natural-language question to the Purple AI LLM, which returns a PowerQuery and a summary. (plugins/s1-secops-skills/docs/mcp-tools.md#L233)
- Sends data to VirusTotal (other, by default): File hashes, IPs, domains, URLs and search strings are sent to VirusTotal under the user's key. (plugins/s1-secops-skills/THIRD_PARTY_NOTICES.md#L19)
- Sends data to Shodan (other, if you turn it on): IPs, hostnames, domains, search queries and CVE/CPE identifiers are sent to Shodan when the optional server is installed. (plugins/s1-secops-skills/THIRD_PARTY_NOTICES.md#L20)
- Sends data to cve-search.org (CIRCL) (other, by default): purple-mcp CVE tools query cve-search.org (CIRCL) without a key. (plugins/s1-secops-skills/docs/mcp-tools.md#L252)
- Sends data to Docker Hub (download, by default): The install step pulls the Docker image sentinelone/secops-mcps:1.5.6. (plugins/s1-secops-skills/README.md#L461)

## What you need

- Credentials: A SentinelOne Management Console API token from a service user plus the console URL. (plugins/s1-secops-skills/README.md#L487)
- Authorisation: Token role Viewer or higher for reads; IR Team or higher for response actions. (plugins/s1-secops-skills/docs/installation.md#L209)
- Container runtime: Docker Desktop or Docker Engine, running. (plugins/s1-secops-skills/docs/installation.md#L25)
- Operating system: An OS keychain: macOS keychain, Linux Secret Service (unlocked) or Windows Credential Manager. (plugins/s1-secops-skills/docs/installation.md#L26)
- Credentials: A VirusTotal API key, used by the VirusTotal MCP and purple-mcp threat-intel tools. (plugins/s1-secops-skills/README.md#L491)
- Other: The documented plugin install uploads the .plugin file in Claude Desktop under Cowork, Customize, Browse plugins. (plugins/s1-secops-skills/README.md#L523)
- Account: purple_ai queries need a Purple AI entitlement on the tenant. (plugins/s1-secops-skills/docs/mcp-tools.md#L233)
- Setting: Tenant-changing tools need S1_READ_ONLY=false on s1-secops-mcp and a client restart. (plugins/s1-secops-skills/docs/read-only.md#L31)
- Installer: On macOS/Linux the one-line installer downloads the launcher from the main branch with curl into ~/.local/bin and runs it with sh install. (plugins/s1-secops-skills/README.md#L446)
- Installer: On Windows the installer downloads the .ps1 launcher from the main branch to TEMP and runs it with PowerShell and ExecutionPolicy Bypass. (plugins/s1-secops-skills/README.md#L452)
- Installer: install writes the MCP entries into claude_desktop_config.json, keeps other servers, removes older launcher entries and saves a dated backup. (plugins/s1-secops-skills/docs/installation.md#L60)
- Installer: For Claude Code, the plugin README says to change into a folder that contains CLAUDE.md and run claude, which reads CLAUDE.md on startup. (plugins/s1-secops-skills/README.md#L138-142)
- Installer: The repository root holds a Claude plugin marketplace file that lists s1-secops-skills with the source ./plugins/s1-secops-skills. (.claude-plugin/marketplace.json#L12-15)

## Limits and risks

- Read-only mode applies to s1-secops-mcp only; purple-mcp, the VirusTotal MCP and the Shodan MCP are not affected by it. (plugins/s1-secops-skills/docs/read-only.md#L22)
- A PowerQuery with | savelookup sent through purple-mcp writes a lookup table even when s1-secops-mcp is read-only. (plugins/s1-secops-skills/docs/read-only.md#L73)
- With write enabled the assistant can create, modify and delete console objects under the token's permissions; the author warns some changes cannot be undone. (plugins/s1-secops-skills/docs/read-only.md#L7)
- The keychain does not protect tokens from other processes running as the same user. (plugins/s1-secops-skills/docs/credentials.md#L271)
- Indicators submitted to VirusTotal or Shodan may become visible to the provider and, depending on plan, to its other users. (plugins/s1-secops-skills/THIRD_PARTY_NOTICES.md#L28)
- The Hyperautomation autonomous SOC template builds workflows that take an alert to an executed response with no analyst in the loop. (plugins/s1-secops-skills/skills/hyperautomation/references/autonomous-soc-template.md#L3)
- CLAUDE.md tells Claude to propose edits to CLAUDE.md itself at the end of each session and apply them after explicit user approval. (plugins/s1-secops-skills/CLAUDE.md#L745-750)
- The host-only Python client S1Client has generic put and delete methods for console API paths. (plugins/s1-secops-skills/skills/mgmt-console-api/scripts/s1_client.py#L389-394)
- s1-secops-mcp starts in read-only mode: all tools stay listed, but any call that would change the tenant is refused before a network request is made. (plugins/s1-secops-skills/docs/read-only.md#L20)
- Workflows and rules created with a Service User token are invisible to human users in the console UI. (plugins/s1-secops-skills/docs/credentials.md#L259)
- powerquery_run, s1_api_get, s1_api_download and ha_export_workflow can write results to an absolute path inside S1_OUTPUT_DIRS, which defaults to the home and temp directories. (plugins/s1-secops-skills/docs/architecture.md#L62)
- When a chat starts in the PrincipalSOCAnalyst project, Claude reads CLAUDE.md and immediately runs data source enumeration and pulls open alerts. (plugins/s1-secops-skills/README.md#L127-130)
- With write enabled, each allowed write logs one stderr line with tool and path, without request bodies, tokens or headers. (plugins/s1-secops-skills/docs/read-only.md#L81)

## Rights in plain language

- Declared: files 2 (writes outside the project), network 3 (can tunnel or exfiltrate), execution 2 (runs shell commands or eval), secrets 2 (reads broad tokens or the environment), persistence 3 (adds autostart, users or keys), approval 0 (asks each time).
- Code: reach 3 (privileged): files 2 (writes outside the project), network 3 (can tunnel or exfiltrate), execution 2 (runs shell commands or eval), secrets 2 (reads broad tokens or the environment), persistence 3 (adds autostart, users or keys); unknown: approval.
- Lab: not run yet.

Why three columns? Declarations are often incomplete and scanners can be bypassed, so we run each tool once and compare.

## Privilege Reach

Reach level 3 (privileged).

| Right | Declared | Code | Lab |
|---|---|---|---|
| Files: where does it read and write? | 2 writes outside the project | 2 writes outside the project | not run yet |
| Network: whom does it talk to? | 3 can tunnel or exfiltrate | 3 can tunnel or exfiltrate | not run yet |
| Execution: what does it run? | 2 runs shell commands or eval | 2 runs shell commands or eval | not run yet |
| Secrets: which credentials does it touch? | 2 reads broad tokens or the environment | 2 reads broad tokens or the environment | not run yet |
| Persistence: what survives the run? | 3 adds autostart, users or keys | 3 adds autostart, users or keys | not run yet |
| Approval: does it ask before acting? | 0 asks each time | ? unknown | not run yet |

0 contained · 1 scoped · 2 open · 3 privileged · ? no evidence · 0 never means safe

## Install

### Upstream

Quoted from `plugins/s1-secops-skills/README.md#L523` at the pinned commit (not a command to copy): `Download the latest `s1-secops-skills-v*.plugin` from [ai-siem `plugins/s1-secops-skills/dist/`](./dist/). In Claude Desktop: **Cowork → Customize → Browse plugins**, then upload the `.plugin` file. All eight skills install in one step.`


### Run it with least privilege

- note: `derived from the code, not tested in the lab; keep s1-secops-mcp in read-only mode, give the console token the Viewer role unless response actions are needed, review CLAUDE.md before the persona edits itself, and install the launcher from a release tag rather than the main branch`

- derived, not tested: proposed from the code analysis

## Lab runs

Not run yet.

## Questions and answers

**Why compare declared, code and lab?**

Declarations are often incomplete and scanners can be bypassed, so we run each tool once and compare.

**What rights does SentinelOne AI Analyst: Claude Skills declare?**

files 2 (writes outside the project), network 3 (can tunnel or exfiltrate), execution 2 (runs shell commands or eval), secrets 2 (reads broad tokens or the environment), persistence 3 (adds autostart, users or keys), approval 0 (asks each time).

**What does its code suggest?**

reach 3 (privileged): files 2 (writes outside the project), network 3 (can tunnel or exfiltrate), execution 2 (runs shell commands or eval), secrets 2 (reads broad tokens or the environment), persistence 3 (adds autostart, users or keys); unknown: approval.

**What did it use when it ran in the lab?**

not run yet.

**Was it tried, and when?**

Not yet (tier listed).

**What changed since the last check?**

Upstream last pushed 2026-10-20; 0 release(s) since the pinned version.

**How do I run it with least privilege?**

Derived, not tested: note: derived from the code, not tested in the lab; keep s1-secops-mcp in read-only mode, give the console token the Viewer role unless response actions are needed, review CLAUDE.md before the persona edits itself, and install the launcher from a release tag rather than the main branch

Method: https://readbeforerun.ai/method/