ReadBeforeRunAgentic Security Field Guide

Catalog / Plugin

SentinelOne AI Analyst: Claude Skills

Draft · awaiting review

Claude plugin with eight SentinelOne skills for threat hunting, alert triage, detections, dashboards, parsers and Hyperautomation workflows.

For Alert triage, Detection engineeringWorks with Claude CodeMaintained Sentinel-One, last push 2026-10-20

PluginA plugin bundles skills, commands, hooks or MCP servers for one AI client. by Sentinel-One · read from the code at b84fba9 (v_1_99_0) on 2026-10-21The date we last read the tool’s files. The code after “at” names the exact version (the git commit) we read; a newer version may differ. · Not run yet.Whether we have run the tool in our lab. “Did more than it said” means the run used rights its description does not name; “did no more than it said” means it stayed within them.

Code showsWhat a reading of the code found the tool can do, at the checked version, in the words of the rights table in the record. It is a ceiling, not what the tool did. A right marked unknown has no evidence either way, and that never counts as harmless.

What the code shows, worst first. No run advice yet: the one word needs a read under the full rule.

  1. Network. The demo console opens an HTTP listener on 127.0.0.1 that forwards browser requests to the data lake with the console token added, guarded by an origin check and a session token.

    server.py L217

  2. Persistence. The shipped persona tells the agent to rewrite its own CLAUDE.md at the end of every session once the user approves, which is a change to agent configuration.

    CLAUDE.md L745

  3. Files. The client deletes data-lake configuration files such as dashboards, parsers and lookups on the target tenant.

    sdl_client.py L753

  4. Execution. A recipe runs RemoteOps scripts on managed endpoints through the console API, which is code execution on the target.

    WORKFLOWS.md L159

  5. Secrets. Three secrets are read from environment variables or from the tool's own keychain items, with no wider credential-store access.

    s1_keystore.py L52-56

  6. Approval. Unknown: no pre-approvals were found, but the download is incomplete and the search patterns for approvals match several lines, so a zero cannot be written. That never counts as zero.

Before first useSettings for your AI client that limit the tool to the rights its task needs; derived from the code unless marked tested. derived from the code, not tested

  1. Keep s1-secops-mcp in read-only mode, give the console token the Viewer role unless response actions are needed, review CLAUDE.md before the persona edits itself, and install the launcher from a release tag rather than the main branch.

What we checked, and what we foundDisagree?

Plugin · code showsreach 3 · privileged
23223?FilesNetworkExecutionSecretsPersistenceApproval

What the code can reach, 0 to 3 per right; a dashed point means no evidence, never zero. The three readings

Is it for you?

Made for
  • Lets Claude hunt threats, triage alerts, write detections, deploy dashboards, author parsers and build automation workflows for a SentinelOne tenant from natural language.
  • CLAUDE.md sets a Principal SOC Analyst persona that runs the same enrichment, correlation and reasoning process on every alert.
  • The sdl-solutions skill deploys packaged Singularity Data Lake solutions into a site from one prompt.
Use it when
  • List open threats, triage UAM alerts, add analyst notes, change alert status or isolate an endpoint Alert triage
  • Scaffold a Git and CI pipeline that keeps detection rules as TOML and syncs them to the Custom Detection Rule API Detection engineering
  • Run a staged DFIR investigation of SentinelOne alerts in SHORT, MEDIUM or LONG mode Incident response and forensics (DFIR)
  • Enrich IPs, domains, hashes and URLs through the configured threat-intel MCP before a verdict Threat intel enrichment
Not for
  • The powerquery skill is not for Microsoft Power Query, M, Excel or Splunk SPL.
  • sdl-solutions is not for one-off queries or standalone parser authoring.
  • The author says to enable write access only when authorised to change the tenant, and only for as long as needed.
You need
  • A SentinelOne Management Console API token from a service user plus the console URL
  • Token role Viewer or higher for reads; IR Team or higher for response actions
  • Docker Desktop or Docker Engine, running

+5 more

Details

Install

linked, not distributed: the Field Guide does not bundle agents or MCP servers

Upstream

Download the latest `s1-secops-skills-v*.plugin` from [ai-siem `plugins/s1-secops-skills/dist/`](./dist/). In Claude Desktop: **Cowork → Customize → Browse plugins**, then upload the `.plugin` file. All eight skills install in one step.
Quoted from plugins/s1-secops-skills/README.md#L523 at the pinned commit; a quotation, not a command to copy.

Run it with least privilege

note
derived from the code, not tested in the lab; keep s1-secops-mcp in read-only mode, give the console token the Viewer role unless response actions are needed, review CLAUDE.md before the persona edits itself, and install the launcher from a release tag rather than the main branch

derived, not tested: proposed from the code analysis

End of the card. Below: what we checked, and what we found.MarkdownJSON

The record · every value with its evidence

What we checked, and what we found.

Profile read at commit b84fba9 on 2026-10-25: 66 facts, each with its quoted line confirmed by script; not installed, not run in the lab.Each fact was read from the tool's files at the checked version and links to the line it comes from. Where nothing was found, the page says so instead of assuming “none”.

Selected by criteria v0.1, approved by Ilja Schlak: awaiting approval. Each section opens with the answer; the file and line of every fact follow it.

What it can change the capability groups as upstream groups them, worst first

Changes, deletes, runs commands, sends data out, according to the capabilities read.

The plugin bundles eight skills. installation.md L157

Partly listed: Individual tool lists of s1-secops-mcp (35), purple-mcp and Shodan MCP; the ten sdl-solutions one by one; Windsurf workflow files; report builders (build_docx/pptx)

GroupWhat it coversEffectOn by default
mgmt-console-apiManagement Console REST v2.1, UAM GraphQL and Purple AI calls through the s1_api_* and uam_* tools, including PUT, PATCH and DELETE. SKILL.md L12reads, changes, deletesyes
hyperautomationha_* tools list, get, import, export and delete Hyperautomation workflows; s1_api_post, s1_api_put and s1_api_delete publish, activate, deactivate and run them now. SKILL.md L35reads, changes, deletesyes
host-only Python scriptsPython clients under scripts/ (S1Client, pq.py, unified_alerts.py and others) that Claude Code or a terminal runs on the host. SKILL.md L14reads, changes, runs commandsno, optional
soc-investigatorSends external IPs, domains, URLs and hashes to the configured threat-intel MCP before a verdict, skipped when the user asks for SentinelOne-only analysis or none is configured. SKILL.md L31reads, sends data outyes
powerquerypowerquery_run runs every query that does not write; a query with | savelookup creates or overwrites a lookup table and is refused while s1-secops-mcp is read-only. read-only.md L63reads, changesyes
sdl-apiSingularity Data Lake API: event ingest, queries and configuration files such as parsers, dashboards and lookups. README.md L81reads, changesyes
sdl-dashboardDesigns, authors and deploys SDL dashboards with panels, tabs and parameters. README.md L82reads, changesyes
sdl-log-parserAuthors SDL log parsers and validates each one end to end: putFile, then HEC ingest with the parser applied, then a query. SKILL.md L4reads, changesyes
sdl-solutionsUmbrella skill for ten packaged SDL solutions (onboarding, enrichment, UEBA, ingest health, exclusions, RBA, DaC, noise reduction, MITRE mapping, query slicing). README.md L85reads, changesyes
CLAUDE.md personaSession protocol that enumerates SDL sources, triages alerts and writes s1_sdl_schema_cache.json into the project root. CLAUDE.md L39reads, changesyes

Where it sends data and who can connect to it

6 outside connections found in the files read: SentinelOne console and SDL APIs, Purple AI, VirusTotal, Shodan, cve-search.org (CIRCL), Docker Hub.

One listener in the files read.

Other connections not ruled out: read in the documentation and the cited code, not searched in full.

How it runs generated from the files read, never drawn by hand

The s1-secops-mcp server runs on the user's machine as a local Node.js process or as the Docker image started by the host launcher, over stdio and outside the Cowork sandbox; it carries all SentinelOne API calls and reads credentials from environment variables, then the OS keychain. architecture.md L60

Your AI client

Parts that live inside the AI client: skill instructions, client configuration.

Your machine

Programs and files on the machine where you run the tool.

Container on your machine

Parts inside a container that the tool starts on your machine.

Outside your machine

Remote services: vendor APIs, model providers, targets, telemetry endpoints. Data sent here leaves your machine.

The six rights, read three waysThe six rights a tool can take (files, network, execution, secrets, persistence, approval), each read three ways and rated 0 to 3. 0 never means safe; “?” means no evidence. what the author says, what the code shows, what one lab run showed

Level 3 (privileged), read from the code. Not run in our lab yet.

RightAuthor sayswhat the author saysCode showswhat static analysis findsRun showedwhat one lab run showed
Fileswhere does it read and write?
Networkwhom does it talk to?
Executionwhat does it run?
Secretswhich credentials does it touch?
Persistencewhat survives the run?
Approvaldoes it ask before acting?

0 contained · 1 scoped · 2 open · 3 privileged · ? no evidence · 0 never means safe · zero means: none declared (Declared), none found (Code), none observed (Lab)

Author says: the evidence

  • Files · 2mcp-tools.md L27 the author allows output files anywhere under the home and temp directories by default, outside the working directory
  • Network · 3README.md L10 the author documents an optional local proxy and static HTTP server for a demo console, which is a listener, while the other declared hosts are the SentinelOne console, VirusTotal and Shodan
  • Execution · 2SKILL.md L174 the author lists script execution through RemoteOps on managed endpoints among the reachable operations
  • Secrets · 2credentials.md L21 the author declares one broad console API token for all data-lake operations, plus a log write key and VirusTotal and Shodan keys
  • Persistence · 3installation.md L60 the documented installer adds three MCP servers to the Claude Desktop configuration, which is a change to agent configuration
  • Approval · 0SKILL.md L174 the author requires an explicit user confirmation before any call that changes agents, policies or tenant configuration and declares no pre-approvals

Code shows: the evidence

  • Files · 2sdl_client.py L753 the client deletes data-lake configuration files such as dashboards, parsers and lookups on the target tenant
  • Network · 3server.py L217 the demo console opens an HTTP listener on 127.0.0.1 that forwards browser requests to the data lake with the console token added, guarded by an origin check and a session token
  • Execution · 2WORKFLOWS.md L159 a recipe runs RemoteOps scripts on managed endpoints through the console API, which is code execution on the target
  • Secrets · 2s1_keystore.py L52-56 three secrets are read from environment variables or from the tool's own keychain items, with no wider credential-store access
  • Persistence · 3CLAUDE.md L745 the shipped persona tells the agent to rewrite its own CLAUDE.md at the end of every session once the user approves, which is a change to agent configuration
  • Approval · ?no evidence: no pre-approvals were found, but the download is incomplete and the search patterns for approvals match several lines, so a zero cannot be written

Valid for commit b84fba9 (v_1_99_0) · checked 2026-10-21 · method reach-v0.1The published rules we follow: how tools are selected, how their rights are read and rated, how a lab run is done.

Limits and risks what the files say that fits nowhere else, and what this reading does not cover

What you need and what the documented installer does

KindWhat
AI clientClaude Code; sign-in: Access token
CredentialsA SentinelOne Management Console API token from a service user plus the console URL. README.md L487
AuthorisationToken role Viewer or higher for reads; IR Team or higher for response actions. installation.md L209
Container runtimeDocker Desktop or Docker Engine, running. installation.md L25
Operating systemAn OS keychain: macOS keychain, Linux Secret Service (unlocked) or Windows Credential Manager. installation.md L26
CredentialsA VirusTotal API key, used by the VirusTotal MCP and purple-mcp threat-intel tools. README.md L491
OtherThe documented plugin install uploads the .plugin file in Claude Desktop under Cowork, Customize, Browse plugins. README.md L523
Accountpurple_ai queries need a Purple AI entitlement on the tenant. mcp-tools.md L233
SettingTenant-changing tools need S1_READ_ONLY=false on s1-secops-mcp and a client restart. read-only.md L31

What the documented installer does

Lab runs one run is an observation, not a benchmark

No lab run yet. Once we run it, this section shows what it did and whether it did more than it said.

About this entry

Type
Plugin · Defensive · works with Claude Code
Source
github.com/Sentinel-One/ai-siem · plugins/s1-secops-skills · AGPL-3.0-only · manifest plugin.json
Version readThe install command installs exactly the version we checked (the pinned git commit), so what you get is what the card describes.
b84fba9 · v_1_99_0 · last upstream push 2026-10-20 · no release since the pinned commit (current v_1_99_0)
In the catalog
listed · added 2026-10-21 · last checked 2026-10-21 · next check 2027-01-19 · fresh
ScannersA scan of the tool's files with a scanner for malicious patterns. “Pending” means it has not run yet.
cisco-skill-scanner: not run, pending
Changes
none since the entry was added on 2026-10-21
MethodThe published rules we follow: how tools are selected, how their rights are read and rated, how a lab run is done.
v0.1 · reach-v0.1 · badge · the rules

Disagree?

Dispute a value with evidence (file, line, commit): write to hello@readbeforerun.ai. A dispute is checked against the pinned commit; a changed value is logged under Changes.

This entry as Markdownas JSON

How this entry was checked, and how to cite it

Selected by the published criteria (method v0.1). What the author says comes only from author statements; what the code shows comes from the code and manifests at commit b84fba9, each with one evidence line. A “?” means no evidence, never zero; zero never means safe.

The descriptive profile (what it does, can do, how it runs, what it needs) was read through the same isolated pipeline at commit b84fba9 on 2026-10-25: one reader proposed every fact with a quoted line, a script confirmed each quoted line (66 of 66), and a second reader checked each sentence against its lines. Where nothing was found, the page says so instead of assuming “none”.

Known issues and limits: remote server-side behaviour stays “?”; the lab is not your production; static analysis can miss runtime behaviour.

Placement, badges or fast tracks are not for sale. The author is employed by an IT consultancy; the company has no influence on selection, execution or result.

Cite this:

Ilja Schlak. "SentinelOne AI Analyst: Claude Skills". Agentic Security Field Guide, checked 2026-10-21, method reach-v0.1. https://readbeforerun.ai/catalog/sentinelone-s1-secops-skills/

The method · the rules

For maintainers

Badge for your README (reach 3 · not run yet):

[![reach 3 · not run yet](https://readbeforerun.ai/badge/sentinelone-s1-secops-skills.svg)](https://readbeforerun.ai/catalog/sentinelone-s1-secops-skills/)

Dispute a value with evidence (file, line, commit): write to hello@readbeforerun.ai. A dispute is checked against the pinned commit; a changed value is logged under Changes.

Claim the entry with a fieldguide.yaml in your repository: planned.

Other tools for the same task

Tasks: Alert triage, Detection engineering. The task pages compare every tool side by side.
  1. 23112?
    CrowdStrike Falcon MCP ServerMCP server · by CrowdStrike · reach 3, privilegedDraft · awaiting review

    MCP server that connects agents to the CrowdStrike Falcon platform: detections, threat intel, host management and response.

    Can tunnel or exfiltrate · write outside the project · change config or install globally · Approval: no evidence · ran once, 2026-11-07: did more than it said · checked 2026-11-07

    Code shows
  2. 23122?
    GitGuardian MCP ServerMCP server · by GitGuardian · reach 3, privilegedDraft · awaiting review

    MCP server that brings GitGuardian secret detection, incident triage and honeytokens into an AI agent.

    Can tunnel or exfiltrate · write outside the project · read broad tokens or the environment · +1 more · Approval: no evidence · ran once, 2026-11-07: did no more than it said · checked 2026-11-07

    Code shows
  3. 11032?
    Google Security Operations MCP ServerMCP server · by google · reach 3, privilegedDraft · awaiting review

    MCP server for Google Security Operations (Chronicle) with 68 tools for event search, alerts, detection rules, log ingestion and SIEM configuration.

    Can read credential stores · change config or install globally · Approval: no evidence · not run yet · checked 2026-10-21

    Code shows
  4. 13023?
    Purple AI MCP ServerMCP server · by Sentinel-One · reach 3, privilegedDraft · awaiting review

    Read-only MCP server for the SentinelOne Singularity platform: Purple AI, data-lake PowerQuery, alerts, vulnerabilities, misconfigurations and inventory.

    Can tunnel or exfiltrate · add autostart, users or keys · read broad tokens or the environment · Approval: no evidence · not run yet · checked 2026-10-21

    Code shows
  5. 21122?
    SentinelOne MCP Server (s1-secops-mcp)MCP server · by Sentinel-One · reach ≥2, openDraft · awaiting review

    Node.js MCP server with 35 tools for the SentinelOne console, data lake, alert management and Hyperautomation, read-only by default.

    Can write outside the project · read broad tokens or the environment · change config or install globally · Approval: no evidence · not run yet · checked 2026-10-21

    Code shows
  6. 102?00
    Malware AnalystSkill · by tomabai · reach ≥2, openDraft · awaiting review

    Agent skill that walks through a static malware analysis: deobfuscation, IOC extraction and detection signatures.

    Can run shell commands or eval · Secrets: no evidence · not run yet · checked 2026-10-21

    Code shows