Security 🧪 Community ✓ Claude Code ✓ Claude Desktop Standalone • SentinelOne

SentinelOne

SentinelOne XDR - threat detection, incident response, and endpoint agent management via the Purple AI MCP server

Installation

Install this plugin individually:

/plugin marketplace add wyre-technology/msp-claude-plugins --plugin sentinelone

Or install all MSP plugins at once:

/plugin marketplace add wyre-technology/msp-claude-plugins

Features

Alert Handling
Asset Inventory
Cloud Security Posture
Purple AI Threat Hunting
PowerQuery Analytics
Vulnerability Management

Skills

This plugin provides 7 skills that teach Claude about SentinelOne:

Skill	Description
`alerts`	SentinelOne's read-only unified alert surface: the list/search/get alert tools plus notes and history, severity levels, status values, view types, GraphQL filter syntax, and cursor-based pagination.
`inventory`	SentinelOne's unified asset inventory across four surface types — agent-managed endpoints, AWS/Azure/GCP cloud resources, AD/Entra identities, and Ranger-discovered network devices.
`misconfigurations`	Cloud security posture findings from SentinelOne's XSPM module across AWS, Azure, GCP, Kubernetes, identity providers, and infrastructure-as-code.
`purple-ai`	The `purple_ai` tool — SentinelOne's natural language investigation assistant over the full Singularity telemetry model.
`threat-hunting`	PowerQuery against the Singularity Data Lake: the Scalyr-based pipeline syntax (distinct from SPL, SQL, KQL, and Elasticsearch DSL), the powerquery, get_timestamp_range, and iso_to_unix_timestamp tools, time-range and row-limit handling, common hunting scenarios, and the Purple AI generation path.
`vulnerabilities`	CVE tracking through SentinelOne's XSPM module: the read-only vulnerability tools, EPSS scores and exploit-maturity values and why they outrank raw CVSS severity for prioritization, status values and their transitions, the vulnerability field reference, and patch-prioritization and reporting workflows.
`api-patterns`	The SentinelOne Purple MCP server and the APIs behind it: uvx installation and transport modes, Service User token levels, the 23 read-only tools organized by domain, and the dual GraphQL (cursor pagination) / REST (offset pagination) architecture with its differing filter syntaxes, rate limits, and error causes.

Agents

This plugin provides 2 agents for autonomous task execution:

Agent	Description
`endpoint-hardening-auditor`	Use this agent when an MSP needs to audit and harden SentinelOne endpoint configuration across client sites — not to investigate active threats, but to proactively identify gaps before attackers can exploit them.
`threat-hunter`	Use this agent when an MSP needs to autonomously hunt for threats across client endpoints using SentinelOne.

Commands

Available slash commands:

Command	Description
`/alert-triage`	Triage new and unresolved SentinelOne alerts by severity
`/asset-inventory`	Asset inventory summary by surface type across managed environments
`/hunt-threat`	Threat hunting via Purple AI and PowerQuery execution
`/investigate-alert`	Deep investigation of a specific SentinelOne alert with timeline and context
`/posture-review`	Cloud security posture review with compliance gap analysis
`/vuln-report`	Generate a vulnerability summary report with severity breakdown and top CVEs

API Reference

Base URL
Authentication
Rate Limit
Documentation

Example Usage

Triage new and unresolved SentinelOne alerts by severity

/alert-triage

Asset inventory summary by surface type across managed environments

/asset-inventory

Threat hunting via Purple AI and PowerQuery execution

/hunt-threat

Deep investigation of a specific SentinelOne alert with timeline and context

/investigate-alert

Cloud security posture review with compliance gap analysis

/posture-review

Generate a vulnerability summary report with severity breakdown and top CVEs

/vuln-report

Using Skills

/skill sentinelone:alerts

SentinelOne's read-only unified alert surface: the list/search/get alert tools plus notes and history, severity levels, status values, view types, GraphQL filter syntax, and cursor-based pagination.