sentinelone

Plugin sentinelone from marketplace msp-claude-plugins in WYRE-AI/msp-claude-plugins. Commands read from the repo's manifest — yesterday.

Skills (8)

• sentinelone-alerts

  SentinelOne's read-only unified alert surface: the list/search/get alert tools plus notes and history, severity levels, status values, view types, GraphQL filter syntax, and cursor-based pagination.

• SentinelOne API Patterns

  The SentinelOne Purple MCP server and the APIs behind it: uvx installation and transport modes, Service User token levels, the 23 read-only tools organized by domain, and the dual GraphQL (cursor pagination) / REST (offset pagination) architecture with its differing filter syntaxes, rate limits, and

• SentinelOne Inventory

  SentinelOne's unified asset inventory across four surface types — agent-managed endpoints, AWS/Azure/GCP cloud resources, AD/Entra identities, and Ranger-discovered network devices. Covers the read-only inventory tools, the REST (not GraphQL) offset-pagination and filter model, asset field reference

• SentinelOne Misconfigurations

  Cloud security posture findings from SentinelOne's XSPM module across AWS, Azure, GCP, Kubernetes, identity providers, and infrastructure-as-code. Covers the read-only misconfiguration tools, view types, severity and status values, compliance-standard and MITRE ATT&CK mappings, evidence fields, and

• SentinelOne Purple AI

  The `purple_ai` tool — SentinelOne's natural language investigation assistant over the full Singularity telemetry model. Covers how to phrase investigative prompts, behavioral anomaly and MITRE ATT&CK TTP analysis, PowerQuery generation, and handing generated queries to the `powerquery` tool for exe

• SentinelOne Threat Hunting

  PowerQuery against the Singularity Data Lake: the Scalyr-based pipeline syntax (distinct from SPL, SQL, KQL, and Elasticsearch DSL), the powerquery, get_timestamp_range, and iso_to_unix_timestamp tools, time-range and row-limit handling, common hunting scenarios, and the Purple AI generation path. W

• SentinelOne Threat Intel and CVE Lookup

  The SentinelOne sidecar's enrichment tools: VirusTotal / Google Threat Intelligence lookups by hash, IP, domain and URL (threat_intel_*), sandbox behaviour and file relationships, advanced VirusTotal search, and the CVE database (cve_search_by_id, cve_search_by_vendor, cve_database_status). When enr

• SentinelOne Vulnerabilities

  CVE tracking through SentinelOne's XSPM module: the read-only vulnerability tools, EPSS scores and exploit-maturity values and why they outrank raw CVSS severity for prioritization, status values and their transitions, the vulnerability field reference, and patch-prioritization and reporting workflo

Slash commands (6)

• /sentinelone:alert-triage

  Triage new and unresolved SentinelOne alerts by severity

• /sentinelone:asset-inventory

  Asset inventory summary by surface type across managed environments

• /sentinelone:hunt-threat

  Threat hunting via Purple AI and PowerQuery execution

• /sentinelone:investigate-alert

  Deep investigation of a specific SentinelOne alert with timeline and context

• /sentinelone:posture-review

  Cloud security posture review with compliance gap analysis

• /sentinelone:vuln-report

  Generate a vulnerability summary report with severity breakdown and top CVEs

Subagents (2)

• endpoint-hardening-auditor

  Use this agent when an MSP needs to audit and harden SentinelOne endpoint configuration across client sites — not to investigate active threats, but to proactively identify gaps before attackers can exploit them. Trigger for: endpoint hardening, policy compliance, SentinelOne policy audit, agent hea

• threat-hunter

  Use this agent when an MSP needs to autonomously hunt for threats across client endpoints using SentinelOne. Trigger for: IOC sweep, threat hunt, indicator sweep, PowerQuery hunt, lateral movement investigation, ransomware indicators, C2 beaconing, MITRE ATT&CK TTP analysis, incident investigation,

Similar plugins