{ "$schema": "https://readbeforerun.ai/schema/entry.schema.json", "entry": { "id": "sentinelone-s1-secops-skills", "name": "SentinelOne AI Analyst: Claude Skills", "summary": "Claude plugin with eight SentinelOne skills for threat hunting, alert triage, detections, dashboards, parsers and Hyperautomation workflows.", "draft": "review", "type": "plugin", "mission": [ "defensive" ], "task": [ "alert-triage", "detection-engineering" ], "domain": [ "security-operations" ], "runtime": [ "claude-code" ], "tier": "listed", "last_checked": "2026-10-21", "next_check": "2027-01-19", "freshness": "fresh", "superseded": false, "in_my_kit": null, "advice": null, "code_shows": "can tunnel or exfiltrate · adds autostart, users or keys · writes outside the project · runs shell commands or eval · reads broad tokens or the environment · Approval: unknown", "source": { "repo": "https://github.com/Sentinel-One/ai-siem", "subpath": "plugins/s1-secops-skills", "commit": "b84fba9f6e838ee7bda1038f2ea8a4e0c1320b2a", "version": "v_1_99_0", "license": "AGPL-3.0-only" }, "install": { "skills_cli": null, "claude_code": null, "upstream": "Download the latest `s1-secops-skills-v*.plugin` from [ai-siem `plugins/s1-secops-skills/dist/`](./dist/). In Claude Desktop: **Cowork → Customize → Browse plugins**, then upload the `.plugin` file. All eight skills install in one step.", "bundled": false }, "scan": { "status": "static scan pending (not run)" }, "reach": { "method": "reach-v0.1", "level": 3, "level_source": "static", "level_label": "privileged", "unknown_axes": 1, "verdict": "not-run", "badge": "reach 3 · not run yet", "long": "reach 3 from code (privileged); lab: not run yet", "declared": { "fs": 2, "net": 3, "exec": 2, "cred": 2, "persist": 3, "hitl": 0 }, "static": { "level": 3, "fs": 2, "net": 3, "exec": 2, "cred": 2, "persist": 3, "hitl": null, "unknown": [ "hitl" ] }, "observed": null, "surplus": null, "fit": null, "exports": { "aivss": { "fs": 0.5, "net": 1, "exec": 0.5, "cred": 0.5, "persist": 1, "hitl": null }, "usf_risk_tier": "L3" } }, "profile": { "read_at": "b84fba9f6e838ee7bda1038f2ea8a4e0c1320b2a", "read_on": "2026-10-25", "overview": "A Claude plugin of SentinelOne SecOps skills for PowerQuery threat hunting and STAR/Custom Detection rules, the Management Console and Singularity Data Lake APIs, SDL dashboards, OCSF log parsing, Hyperautomation SOAR, autonomous DFIR alert investigation and 10 one-prompt SDL solutions.", "purpose": [ "Lets Claude hunt threats, triage alerts, write detections, deploy dashboards, author parsers and build automation workflows for a SentinelOne tenant from natural language.", "CLAUDE.md sets a Principal SOC Analyst persona that runs the same enrichment, correlation and reasoning process on every alert.", "The sdl-solutions skill deploys packaged Singularity Data Lake solutions into a site from one prompt." ], "use_cases": [ { "text": "List open threats, triage UAM alerts, add analyst notes, change alert status or isolate an endpoint", "task": "alert-triage" }, { "text": "Scaffold a Git and CI pipeline that keeps detection rules as TOML and syncs them to the Custom Detection Rule API", "task": "detection-engineering" }, { "text": "Run a staged DFIR investigation of SentinelOne alerts in SHORT, MEDIUM or LONG mode", "task": "dfir" }, { "text": "Enrich IPs, domains, hashes and URLs through the configured threat-intel MCP before a verdict", "task": "threat-intel-enrichment" } ], "maturity": null, "capabilities": [ { "name": "powerquery", "effects": [ "reads", "changes" ], "enabled": "default" }, { "name": "mgmt-console-api", "effects": [ "reads", "changes", "deletes" ], "enabled": "default" }, { "name": "sdl-api", "effects": [ "reads", "changes" ], "enabled": "default" }, { "name": "sdl-dashboard", "effects": [ "reads", "changes" ], "enabled": "default" }, { "name": "sdl-log-parser", "effects": [ "reads", "changes" ], "enabled": "default" }, { "name": "hyperautomation", "effects": [ "reads", "changes", "deletes" ], "enabled": "default" }, { "name": "sdl-solutions", "effects": [ "reads", "changes" ], "enabled": "default" }, { "name": "soc-investigator", "effects": [ "reads", "sends-data" ], "enabled": "default" }, { "name": "CLAUDE.md persona", "effects": [ "reads", "changes" ], "enabled": "default" }, { "name": "host-only Python scripts", "effects": [ "reads", "changes", "runs-commands" ], "enabled": "optional" } ], "effects": [ "reads", "changes", "deletes", "runs-commands", "sends-data" ], "runs": "in-client", "listens": [ { "mode": "optional", "bind": "loopback", "sign_in": "none" } ], "sends_to": [ { "to": "SentinelOne console and SDL APIs", "kind": "vendor-api", "when": "always" }, { "to": "Purple AI", "kind": "vendor-api", "when": "optional" }, { "to": "VirusTotal", "kind": "other", "when": "default" }, { "to": "Shodan", "kind": "other", "when": "optional" }, { "to": "cve-search.org (CIRCL)", "kind": "other", "when": "default" }, { "to": "Docker Hub", "kind": "download", "when": "default" } ], "model": "client", "needs": [ { "kind": "credentials", "text": "A SentinelOne Management Console API token from a service user plus the console URL." }, { "kind": "authorization", "text": "Token role Viewer or higher for reads; IR Team or higher for response actions." }, { "kind": "container", "text": "Docker Desktop or Docker Engine, running." }, { "kind": "os", "text": "An OS keychain: macOS keychain, Linux Secret Service (unlocked) or Windows Credential Manager." }, { "kind": "credentials", "text": "A VirusTotal API key, used by the VirusTotal MCP and purple-mcp threat-intel tools." }, { "kind": "other", "text": "The documented plugin install uploads the .plugin file in Claude Desktop under Cowork, Customize, Browse plugins." }, { "kind": "account", "text": "purple_ai queries need a Purple AI entitlement on the tenant." }, { "kind": "setting", "text": "Tenant-changing tools need S1_READ_ONLY=false on s1-secops-mcp and a client restart." } ] }, "urls": { "page": "/catalog/sentinelone-s1-secops-skills/", "json": "/entries/sentinelone-s1-secops-skills.json", "md": "/catalog/sentinelone-s1-secops-skills.md", "badge": "/badge/sentinelone-s1-secops-skills.svg" } }, "data": { "schema_version": "0.5", "slug": "sentinelone-s1-secops-skills", "name": "SentinelOne AI Analyst: Claude Skills", "summary": "Claude plugin with eight SentinelOne skills for threat hunting, alert triage, detections, dashboards, parsers and Hyperautomation workflows.", "draft": "review", "in_my_kit": null, "type": "plugin", "mission": [ "defensive" ], "task": [ "alert-triage", "detection-engineering" ], "domain": [ "security-operations" ], "phase": [ "def:detect", "def:respond" ], "role": [ "soc", "dfir" ], "runtime": [ "claude-code" ], "auth": "token", "autonomy": null, "addresses": [], "frameworks": { "owasp_ast": [], "owasp_asi": [], "attack_tactic": [], "atlas": [] }, "source": { "repo": "https://github.com/Sentinel-One/ai-siem", "subpath": "plugins/s1-secops-skills", "commit": "b84fba9f6e838ee7bda1038f2ea8a4e0c1320b2a", "version": "v_1_99_0", "license": "AGPL-3.0-only", "manifest": "plugin.json", "also_listed": { "tenable-cyberagents-exchange": "https://github.com/tenable/cyberagents-exchange/blob/9d0ddf1fe8dc9651a0c461a2a27d33cb8a160a2c/skills/sentinelone-ai-analyst-claude-skills.md" } }, "upstream": { "checked_at": "2026-10-21", "updated_at": "2026-10-20", "current_release": "v_1_99_0", "archived": false, "stars": 87, "commit_history": {}, "releases_since_pin": 0 }, "install": { "upstream": "Download the latest `s1-secops-skills-v*.plugin` from [ai-siem `plugins/s1-secops-skills/dist/`](./dist/). In Claude Desktop: **Cowork → Customize → Browse plugins**, then upload the `.plugin` file. All eight skills install in one step.", "upstream_evidence": "plugins/s1-secops-skills/README.md#L523", "bundled": false }, "scan": [ { "tool": "cisco-skill-scanner", "version": "not-run", "llm_judge": false, "date": "2026-10-21", "result": "pending" } ], "privileges": { "method": "reach-v0.1", "declared": { "axes": { "fs": 2, "net": 3, "exec": 2, "cred": 2, "persist": 3, "hitl": 0 }, "evidence": { "fs": "plugins/s1-secops-skills/docs/mcp-tools.md#L27 the author allows output files anywhere under the home and temp directories by default, outside the working directory", "net": "plugins/s1-secops-skills/skills/sdl-solutions/assets/rba_console/README.md#L10 the author documents an optional local proxy and static HTTP server for a demo console, which is a listener, while the other declared hosts are the SentinelOne console, VirusTotal and Shodan", "exec": "plugins/s1-secops-skills/skills/mgmt-console-api/SKILL.md#L174 the author lists script execution through RemoteOps on managed endpoints among the reachable operations", "cred": "plugins/s1-secops-skills/docs/credentials.md#L21 the author declares one broad console API token for all data-lake operations, plus a log write key and VirusTotal and Shodan keys", "persist": "plugins/s1-secops-skills/docs/installation.md#L60 the documented installer adds three MCP servers to the Claude Desktop configuration, which is a change to agent configuration", "hitl": "plugins/s1-secops-skills/skills/mgmt-console-api/SKILL.md#L174 the author requires an explicit user confirmation before any call that changes agents, policies or tenant configuration and declares no pre-approvals" } }, "static": { "level": 3, "axes": { "fs": 2, "net": 3, "exec": 2, "cred": 2, "persist": 3, "hitl": null }, "evidence": { "fs": "plugins/s1-secops-skills/skills/sdl-api/scripts/sdl_client.py#L753 the client deletes data-lake configuration files such as dashboards, parsers and lookups on the target tenant", "net": "plugins/s1-secops-skills/skills/sdl-solutions/assets/rba_console/server.py#L217 the demo console opens an HTTP listener on 127.0.0.1 that forwards browser requests to the data lake with the console token added, guarded by an origin check and a session token", "exec": "plugins/s1-secops-skills/skills/mgmt-console-api/references/WORKFLOWS.md#L159 a recipe runs RemoteOps scripts on managed endpoints through the console API, which is code execution on the target", "cred": "plugins/s1-secops-skills/skills/mgmt-console-api/scripts/s1_keystore.py#L52-56 three secrets are read from environment variables or from the tool's own keychain items, with no wider credential-store access", "persist": "plugins/s1-secops-skills/CLAUDE.md#L745 the shipped persona tells the agent to rewrite its own CLAUDE.md at the end of every session once the user approves, which is a change to agent configuration", "hitl": "no evidence: no pre-approvals were found, but the download is incomplete and the search patterns for approvals match several lines, so a zero cannot be written" }, "unknown": [ "hitl" ] }, "min_config": { "status": "derived", "note": "derived from the code, not tested in the lab; keep s1-secops-mcp in read-only mode, give the console token the Viewer role unless response actions are needed, review CLAUDE.md before the persona edits itself, and install the launcher from a release tag rather than the main branch" }, "override": null, "reviews": [] }, "status": { "tier": "listed", "last_checked": "2026-10-21", "next_check": "2027-01-19", "freshness": "fresh", "superseded": false, "superseded_by": null, "added": "2026-10-21", "added_by": "scout" }, "evidence": { "runs": [], "badge": "/badge/sentinelone-s1-secops-skills.svg" }, "changes": [] }, "profile": { "schema_version": "0.1", "entry": "sentinelone-s1-secops-skills", "draft": "review", "commit": "b84fba9f6e838ee7bda1038f2ea8a4e0c1320b2a", "read_on": "2026-10-25", "check": { "date": "2026-10-25", "facts": 66, "confirmed": 66, "verified": 59 }, "overview": { "text": "A Claude plugin of SentinelOne SecOps skills for PowerQuery threat hunting and STAR/Custom Detection rules, the Management Console and Singularity Data Lake APIs, SDL dashboards, OCSF log parsing, Hyperautomation SOAR, autonomous DFIR alert investigation and 10 one-prompt SDL solutions.", "ev": "plugins/s1-secops-skills/.claude-plugin/plugin.json#L4 plugin description" }, "purpose": [ { "text": "Lets Claude hunt threats, triage alerts, write detections, deploy dashboards, author parsers and build automation workflows for a SentinelOne tenant from natural language.", "ev": "plugins/s1-secops-skills/README.md#L3 author's summary" }, { "text": "CLAUDE.md sets a Principal SOC Analyst persona that runs the same enrichment, correlation and reasoning process on every alert.", "ev": "plugins/s1-secops-skills/README.md#L92 persona purpose" }, { "text": "The sdl-solutions skill deploys packaged Singularity Data Lake solutions into a site from one prompt.", "ev": "plugins/s1-secops-skills/skills/sdl-solutions/SKILL.md#L4 skill description" } ], "use_cases": [ { "text": "List open threats, triage UAM alerts, add analyst notes, change alert status or isolate an endpoint", "task": "alert-triage", "ev": "plugins/s1-secops-skills/README.md#L203 alert and threat management" }, { "text": "Scaffold a Git and CI pipeline that keeps detection rules as TOML and syncs them to the Custom Detection Rule API", "task": "detection-engineering", "ev": "plugins/s1-secops-skills/README.md#L396 Detection as Code solution" }, { "text": "Run a staged DFIR investigation of SentinelOne alerts in SHORT, MEDIUM or LONG mode", "task": "dfir", "ev": "plugins/s1-secops-skills/skills/soc-investigator/SKILL.md#L19 investigation modes" }, { "text": "Enrich IPs, domains, hashes and URLs through the configured threat-intel MCP before a verdict", "task": "threat-intel-enrichment", "ev": "plugins/s1-secops-skills/README.md#L162 investigation workflow enrichment step" } ], "not_for": [ { "text": "The powerquery skill is not for Microsoft Power Query, M, Excel or Splunk SPL.", "ev": "plugins/s1-secops-skills/skills/powerquery/SKILL.md#L5 skill description" }, { "text": "sdl-solutions is not for one-off queries or standalone parser authoring.", "ev": "plugins/s1-secops-skills/skills/sdl-solutions/SKILL.md#L4 skill description" }, { "text": "The author says to enable write access only when authorised to change the tenant, and only for as long as needed.", "ev": "plugins/s1-secops-skills/docs/read-only.md#L11 write-access warning" } ], "capabilities": { "coverage": "partial", "missing": "Individual tool lists of s1-secops-mcp (35), purple-mcp and Shodan MCP; the ten sdl-solutions one by one; Windsurf workflow files; report builders (build_docx/pptx)", "count": { "n": 8, "unit": "skills", "by": "author", "text": "The plugin bundles eight skills.", "ev": "plugins/s1-secops-skills/docs/installation.md#L157 plugin install" }, "groups": [ { "name": "powerquery", "does": "powerquery_run runs every query that does not write; a query with | savelookup creates or overwrites a lookup table and is refused while s1-secops-mcp is read-only.", "effects": [ "reads", "changes" ], "enabled": "default", "ev": "plugins/s1-secops-skills/docs/read-only.md#L63 powerquery_run write condition" }, { "name": "mgmt-console-api", "does": "Management Console REST v2.1, UAM GraphQL and Purple AI calls through the s1_api_* and uam_* tools, including PUT, PATCH and DELETE.", "effects": [ "reads", "changes", "deletes" ], "enabled": "default", "ev": "plugins/s1-secops-skills/skills/mgmt-console-api/SKILL.md#L12 MCP tools used" }, { "name": "sdl-api", "does": "Singularity Data Lake API: event ingest, queries and configuration files such as parsers, dashboards and lookups.", "effects": [ "reads", "changes" ], "enabled": "default", "ev": "plugins/s1-secops-skills/README.md#L81 skill table" }, { "name": "sdl-dashboard", "does": "Designs, authors and deploys SDL dashboards with panels, tabs and parameters.", "effects": [ "reads", "changes" ], "enabled": "default", "ev": "plugins/s1-secops-skills/README.md#L82 skill table" }, { "name": "sdl-log-parser", "does": "Authors SDL log parsers and validates each one end to end: putFile, then HEC ingest with the parser applied, then a query.", "effects": [ "reads", "changes" ], "enabled": "default", "ev": "plugins/s1-secops-skills/skills/sdl-log-parser/SKILL.md#L4 skill description" }, { "name": "hyperautomation", "does": "ha_* tools list, get, import, export and delete Hyperautomation workflows; s1_api_post, s1_api_put and s1_api_delete publish, activate, deactivate and run them now.", "effects": [ "reads", "changes", "deletes" ], "enabled": "default", "ev": "plugins/s1-secops-skills/skills/hyperautomation/SKILL.md#L35 workflow lifecycle tools" }, { "name": "sdl-solutions", "does": "Umbrella skill for ten packaged SDL solutions (onboarding, enrichment, UEBA, ingest health, exclusions, RBA, DaC, noise reduction, MITRE mapping, query slicing).", "effects": [ "reads", "changes" ], "enabled": "default", "ev": "plugins/s1-secops-skills/README.md#L85 skill table" }, { "name": "soc-investigator", "does": "Sends external IPs, domains, URLs and hashes to the configured threat-intel MCP before a verdict, skipped when the user asks for SentinelOne-only analysis or none is configured.", "effects": [ "reads", "sends-data" ], "enabled": "default", "ev": "plugins/s1-secops-skills/skills/soc-investigator/SKILL.md#L31 enrichment rule" }, { "name": "CLAUDE.md persona", "does": "Session protocol that enumerates SDL sources, triages alerts and writes s1_sdl_schema_cache.json into the project root.", "effects": [ "reads", "changes" ], "enabled": "default", "ev": "plugins/s1-secops-skills/CLAUDE.md#L39 schema cache write" }, { "name": "host-only Python scripts", "does": "Python clients under scripts/ (S1Client, pq.py, unified_alerts.py and others) that Claude Code or a terminal runs on the host.", "effects": [ "reads", "changes", "runs-commands" ], "enabled": "optional", "ev": "plugins/s1-secops-skills/skills/mgmt-console-api/SKILL.md#L14 host-only scripts" } ] }, "architecture": { "summary": { "text": "The s1-secops-mcp server runs on the user's machine as a local Node.js process or as the Docker image started by the host launcher, over stdio and outside the Cowork sandbox; it carries all SentinelOne API calls and reads credentials from environment variables, then the OS keychain.", "ev": "plugins/s1-secops-skills/docs/architecture.md#L60 s1-secops-mcp runtime" }, "runs": { "where": "in-client", "text": "Skills are procedural knowledge Claude reads; they do not execute API calls directly when loaded but tell Claude how to use the MCP tools.", "ev": "plugins/s1-secops-skills/docs/architecture.md#L118 skills layer" }, "modes": [ { "where": "local-program", "mode": "host-only Python scripts", "switch": null, "text": "Python clients in the skills run from Claude Code or a terminal on the user's machine.", "ev": "plugins/s1-secops-skills/docs/credentials.md#L239 host-only scripts" }, { "where": "local-service", "mode": "RBA demo console", "switch": null, "text": "An optional local, browser-based console for demoing Risk-Based Alerting.", "ev": "plugins/s1-secops-skills/skills/sdl-solutions/assets/rba_console/README.md#L3 demo console" } ], "parts": [ { "name": "CLAUDE.md persona", "zone": "client", "does": "CLAUDE.md sets the Principal SOC Analyst persona, session protocol and verdict rules.", "ev": "plugins/s1-secops-skills/docs/architecture.md#L48 CLAUDE.md layer" }, { "name": "Skills (8 SKILL.md)", "zone": "client", "does": "Eight SKILL.md files that Claude reads when a request triggers them.", "ev": "plugins/s1-secops-skills/docs/architecture.md#L111 skills layer" }, { "name": "s1-secops-mcp-launch launcher", "zone": "machine", "does": "Host launcher script that reads the OS keychain and passes secrets to the container over stdin.", "ev": "plugins/s1-secops-skills/README.md#L431 launcher role" }, { "name": "sentinelone/secops-mcps MCP servers", "zone": "container", "does": "One Docker image, sentinelone/secops-mcps, ships s1-secops-mcp, purple-mcp, virustotal-mcp and the optional shodan-mcp, version-locked together.", "ev": "plugins/s1-secops-skills/docs/installation.md#L5 image contents" }, { "name": "SentinelOne tenant APIs", "zone": "outside", "does": "SentinelOne endpoints at *.sentinelone.net, which the skills reach through the MCP servers.", "ev": "plugins/s1-secops-skills/README.md#L67 API reach" }, { "name": "VirusTotal / Shodan", "zone": "outside", "does": "Third-party services VirusTotal and Shodan that receive enrichment queries.", "ev": "plugins/s1-secops-skills/THIRD_PARTY_NOTICES.md#L15 third-party services" } ], "listens": [ { "what": "The optional RBA demo console server.py binds its HTTP server to 127.0.0.1 on the port held in PORT.", "mode": "optional", "bind": "loopback", "sign_in": "none", "ev": "plugins/s1-secops-skills/skills/sdl-solutions/assets/rba_console/server.py#L217 bind address" } ], "connections": [ { "to": "SentinelOne console and SDL APIs", "kind": "vendor-api", "when": "always", "what": "API calls with the console token go from the user's machine to the SentinelOne tenant.", "ev": "plugins/s1-secops-skills/docs/architecture.md#L153 direct API path" }, { "to": "Purple AI", "kind": "vendor-api", "when": "optional", "what": "purple_ai sends a natural-language question to the Purple AI LLM, which returns a PowerQuery and a summary.", "ev": "plugins/s1-secops-skills/docs/mcp-tools.md#L233 purple_ai tool" }, { "to": "VirusTotal", "kind": "other", "when": "default", "what": "File hashes, IPs, domains, URLs and search strings are sent to VirusTotal under the user's key.", "ev": "plugins/s1-secops-skills/THIRD_PARTY_NOTICES.md#L19 VirusTotal data" }, { "to": "Shodan", "kind": "other", "when": "optional", "what": "IPs, hostnames, domains, search queries and CVE/CPE identifiers are sent to Shodan when the optional server is installed.", "ev": "plugins/s1-secops-skills/THIRD_PARTY_NOTICES.md#L20 Shodan data" }, { "to": "cve-search.org (CIRCL)", "kind": "other", "when": "default", "what": "purple-mcp CVE tools query cve-search.org (CIRCL) without a key.", "ev": "plugins/s1-secops-skills/docs/mcp-tools.md#L252 CVE tools" }, { "to": "Docker Hub", "kind": "download", "when": "default", "what": "The install step pulls the Docker image sentinelone/secops-mcps:1.5.6.", "ev": "plugins/s1-secops-skills/README.md#L461 install pulls image" } ], "model": { "who": "client", "text": "Claude, the client's model, writes the queries and JSON and makes the API calls through the tools.", "ev": "plugins/s1-secops-skills/README.md#L199 how it works" } }, "needs": [ { "kind": "credentials", "text": "A SentinelOne Management Console API token from a service user plus the console URL.", "ev": "plugins/s1-secops-skills/README.md#L487 credential table" }, { "kind": "authorization", "text": "Token role Viewer or higher for reads; IR Team or higher for response actions.", "ev": "plugins/s1-secops-skills/docs/installation.md#L209 token scope" }, { "kind": "container", "text": "Docker Desktop or Docker Engine, running.", "ev": "plugins/s1-secops-skills/docs/installation.md#L25 prerequisites" }, { "kind": "os", "text": "An OS keychain: macOS keychain, Linux Secret Service (unlocked) or Windows Credential Manager.", "ev": "plugins/s1-secops-skills/docs/installation.md#L26 prerequisites" }, { "kind": "credentials", "text": "A VirusTotal API key, used by the VirusTotal MCP and purple-mcp threat-intel tools.", "ev": "plugins/s1-secops-skills/README.md#L491 credential table" }, { "kind": "other", "text": "The documented plugin install uploads the .plugin file in Claude Desktop under Cowork, Customize, Browse plugins.", "ev": "plugins/s1-secops-skills/README.md#L523 plugin install" }, { "kind": "account", "text": "purple_ai queries need a Purple AI entitlement on the tenant.", "ev": "plugins/s1-secops-skills/docs/mcp-tools.md#L233 purple_ai requirement" }, { "kind": "setting", "text": "Tenant-changing tools need S1_READ_ONLY=false on s1-secops-mcp and a client restart.", "ev": "plugins/s1-secops-skills/docs/read-only.md#L31 enabling write" } ], "installer": [ { "text": "On macOS/Linux the one-line installer downloads the launcher from the main branch with curl into ~/.local/bin and runs it with sh install.", "ev": "plugins/s1-secops-skills/README.md#L446 install command" }, { "text": "On Windows the installer downloads the .ps1 launcher from the main branch to TEMP and runs it with PowerShell and ExecutionPolicy Bypass.", "ev": "plugins/s1-secops-skills/README.md#L452 Windows install command" }, { "text": "install writes the MCP entries into claude_desktop_config.json, keeps other servers, removes older launcher entries and saves a dated backup.", "ev": "plugins/s1-secops-skills/docs/installation.md#L60 install steps" }, { "text": "For Claude Code, the plugin README says to change into a folder that contains CLAUDE.md and run claude, which reads CLAUDE.md on startup.", "ev": "plugins/s1-secops-skills/README.md#L138-142 Claude Code activation steps" }, { "text": "The repository root holds a Claude plugin marketplace file that lists s1-secops-skills with the source ./plugins/s1-secops-skills.", "ev": ".claude-plugin/marketplace.json#L12-15 marketplace plugin entry" } ], "limits": [ { "text": "Read-only mode applies to s1-secops-mcp only; purple-mcp, the VirusTotal MCP and the Shodan MCP are not affected by it.", "ev": "plugins/s1-secops-skills/docs/read-only.md#L22 scope of read-only mode" }, { "text": "A PowerQuery with | savelookup sent through purple-mcp writes a lookup table even when s1-secops-mcp is read-only.", "ev": "plugins/s1-secops-skills/docs/read-only.md#L73 purple-mcp savelookup" }, { "text": "With write enabled the assistant can create, modify and delete console objects under the token's permissions; the author warns some changes cannot be undone.", "ev": "plugins/s1-secops-skills/docs/read-only.md#L7 write warning" }, { "text": "The keychain does not protect tokens from other processes running as the same user.", "ev": "plugins/s1-secops-skills/docs/credentials.md#L271 keychain limits" }, { "text": "Indicators submitted to VirusTotal or Shodan may become visible to the provider and, depending on plan, to its other users.", "ev": "plugins/s1-secops-skills/THIRD_PARTY_NOTICES.md#L28 third-party data exposure" }, { "text": "The Hyperautomation autonomous SOC template builds workflows that take an alert to an executed response with no analyst in the loop.", "ev": "plugins/s1-secops-skills/skills/hyperautomation/references/autonomous-soc-template.md#L3 template definition" }, { "text": "CLAUDE.md tells Claude to propose edits to CLAUDE.md itself at the end of each session and apply them after explicit user approval.", "ev": "plugins/s1-secops-skills/CLAUDE.md#L745-750 self-learning protocol" }, { "text": "The host-only Python client S1Client has generic put and delete methods for console API paths.", "ev": "plugins/s1-secops-skills/skills/mgmt-console-api/scripts/s1_client.py#L389-394 generic write methods" }, { "text": "s1-secops-mcp starts in read-only mode: all tools stay listed, but any call that would change the tenant is refused before a network request is made.", "ev": "plugins/s1-secops-skills/docs/read-only.md#L20 default behaviour of s1-secops-mcp" }, { "text": "Workflows and rules created with a Service User token are invisible to human users in the console UI.", "ev": "plugins/s1-secops-skills/docs/credentials.md#L259 token types table" }, { "text": "powerquery_run, s1_api_get, s1_api_download and ha_export_workflow can write results to an absolute path inside S1_OUTPUT_DIRS, which defaults to the home and temp directories.", "ev": "plugins/s1-secops-skills/docs/architecture.md#L62 outputFile local writes" }, { "text": "When a chat starts in the PrincipalSOCAnalyst project, Claude reads CLAUDE.md and immediately runs data source enumeration and pulls open alerts.", "ev": "plugins/s1-secops-skills/README.md#L127-130 automatic session start actions" }, { "text": "With write enabled, each allowed write logs one stderr line with tool and path, without request bodies, tokens or headers.", "ev": "plugins/s1-secops-skills/docs/read-only.md#L81 audit line control" } ], "not_found": [ { "field": "maturity", "searched": "plugins/s1-secops-skills/README.md, docs/*.md, plugin.json, root README.md for preview/beta/experimental/alpha/stable/deprecated" }, { "field": "autonomy", "searched": "entry type is plugin, not agent; soc-investigator SKILL.md L112/L165-167 and hyperautomation autonomous-soc-template.md noted instead" } ] }, "verdict": null, "runs": [] }