SentinelOne Threat Hunting

SentinelOne PowerQuery / Singularity Data Lake

Overview

PowerQuery is SentinelOne's query language for searching the Singularity Data Lake -- the centralized telemetry repository containing process events, network connections, file operations, registry changes, and other security-relevant data from all managed endpoints and cloud workloads. For MSPs, PowerQuery is the primary tool for deep forensic analysis, threat hunting, and incident investigation across client environments.

IMPORTANT: PowerQuery is a Scalyr-based pipeline query language. It is NOT Splunk SPL, SQL, KQL (Kusto), or Elasticsearch Query DSL. The syntax is fundamentally different. The recommended approach is to use the purple_ai tool to generate PowerQuery strings from natural language descriptions, then execute them with the powerquery tool.

Anti-triggers

• A natural-language question with no query yet. Do not hand-write PowerQuery from a plain-English prompt — sentinelone-purple-ai generates it correctly, and this skill executes what it returns.
• "Threat hunting" on a Huntress tenant. The phrase belongs to both products; the telemetry does not. Huntress raw detections are huntress-signals and its confirmed threats are huntress-incidents.
• A specific alert's timeline. Alert notes and history come from the alert object, not the Data Lake — use sentinelone-alerts.

MCP Tools

Available Tools

Execute a PowerQuery

Call powerquery with a query string and optional time range:

• query: PowerQuery string (required)
• fromDate: Start of time range (ISO 8601 or Unix epoch ms)
• toDate: End of time range (ISO 8601 or Unix epoch ms)

Default time range: Last 24 hours if not specified.

Example: Find PowerShell network connections:

• powerquery with query="EventType = \"IP Connect\" AND SrcProcName = \"powershell.exe\" | columns EndpointName, SrcProcCmdLine, DstIP, DstPort | limit 100"

Example: With custom time range:

• powerquery with query="EventType = \"Process Creation\" AND TgtProcName = \"mimikatz.exe\" | limit 50", fromDate="2026-02-23T00:00:00Z", toDate="2026-02-24T00:00:00Z"

Get Available Time Range

Call get_timestamp_range to determine how far back the Data Lake has data. Returns the earliest and latest available timestamps.

Convert Timestamps

Call iso_to_unix_timestamp to convert ISO 8601 timestamps to Unix epoch milliseconds, which is required by some query parameters.

Key Concepts

PowerQuery Syntax

PowerQuery uses a pipeline model with filters, columns, sorting, and aggregation:

<filter expression>
| columns <field1>, <field2>, ...
| sort -<field>
| limit <n>
| group <field> calculate count() as cnt

Filter Expressions

Filters use field operator value syntax:

Pipeline Operators

Common Event Types

Common Fields

Query Constraints

Common Hunting Scenarios

Lateral Movement

EventType = "Process Creation" AND
(TgtProcName = "psexec.exe" OR TgtProcName = "psexesvc.exe" OR
 TgtProcCmdLine contains "wmic" AND TgtProcCmdLine contains "/node:")
| columns EndpointName, SiteName, SrcProcName, TgtProcName, TgtProcCmdLine, EventTime
| sort -EventTime
| limit 100

Credential Access (LSASS)

EventType = "Process Creation" AND
TgtProcCmdLine contains "lsass" AND
SrcProcName != "svchost.exe" AND SrcProcName != "csrss.exe"
| columns EndpointName, SiteName, SrcProcName, TgtProcName, TgtProcCmdLine, User, EventTime
| sort -EventTime
| limit 100

Persistence (Scheduled Tasks)

EventType = "Process Creation" AND
TgtProcName = "schtasks.exe" AND TgtProcCmdLine contains "/create"
| columns EndpointName, SiteName, SrcProcName, TgtProcCmdLine, User, EventTime
| sort -EventTime
| limit 100

Command & Control (Beaconing)

EventType = "IP Connect" AND NetConnStatus = "SUCCESS" AND
NOT DstIP In ("10.0.0.0/8", "172.16.0.0/12", "192.168.0.0/16") AND
DstPort NOT In (80, 443)
| group DstIP, SrcProcName, EndpointName calculate count() as connections
| filter connections > 50
| sort -connections
| limit 100

Data Staging

EventType = "Process Creation" AND
(TgtProcName In ("7z.exe", "rar.exe", "zip.exe", "tar.exe") OR
 TgtProcCmdLine contains "Compress-Archive")
| columns EndpointName, SiteName, SrcProcName, TgtProcCmdLine, User, EventTime
| sort -EventTime
| limit 100

LOLBIN Activity

EventType = "Process Creation" AND
TgtProcName In ("certutil.exe", "mshta.exe", "regsvr32.exe", "rundll32.exe",
                 "wscript.exe", "cscript.exe", "bitsadmin.exe") AND
(TgtProcCmdLine contains "http" OR TgtProcCmdLine contains "ftp" OR
 TgtProcCmdLine contains "/decode" OR TgtProcCmdLine contains "script:")
| columns EndpointName, SiteName, SrcProcName, TgtProcName, TgtProcCmdLine, EventTime
| sort -EventTime
| limit 100

DNS Tunneling

EventType = "DNS" AND
DNSRequest contains "." AND
NOT DNSRequest In ("*.microsoft.com", "*.windows.com", "*.windowsupdate.com",
                    "*.office.com", "*.sentinelone.net")
| group DNSRequest calculate count() as queries
| filter queries > 100
| sort -queries
| limit 100

Phishing (Office Macro Execution)

EventType = "Process Creation" AND
SrcProcName In ("winword.exe", "excel.exe", "powerpnt.exe") AND
TgtProcName In ("powershell.exe", "cmd.exe", "wscript.exe", "cscript.exe", "mshta.exe")
| columns EndpointName, SiteName, SrcProcName, TgtProcName, TgtProcCmdLine, User, EventTime
| sort -EventTime
| limit 100

Typical Workflow

The recommended threat hunting workflow is:

1. Describe the threat to Purple AI - Call purple_ai with a natural language description of what you want to find
2. Review the generated PowerQuery - Purple AI returns one or more PowerQuery strings
3. Check time range - Call get_timestamp_range to verify data availability
4. Execute the query - Call powerquery with the generated query string
5. Analyze results - Review returned rows for indicators of compromise
6. Iterate - Refine the query based on initial results, or ask Purple AI for follow-up queries

Response Examples

PowerQuery Result:

{
  "rows": [
    {
      "EndpointName": "ACME-WS-042",
      "SrcProcName": "winword.exe",
      "TgtProcName": "powershell.exe",
      "TgtProcCmdLine": "powershell.exe -enc aQBlAHgA...",
      "EventTime": "2026-02-24T08:12:34.000Z"
    },
    {
      "EndpointName": "ACME-WS-015",
      "SrcProcName": "excel.exe",
      "TgtProcName": "cmd.exe",
      "TgtProcCmdLine": "cmd.exe /c whoami && net user",
      "EventTime": "2026-02-24T07:45:12.000Z"
    }
  ],
  "totalRows": 2
}

Empty Result (Valid):

{
  "rows": [],
  "totalRows": 0
}

Empty results are valid and common in threat hunting. No results means no matching telemetry was found -- which is often a positive finding.

Error Handling

Common Errors

PowerQuery Syntax Tips

• String values must be in double quotes: SrcProcName = "powershell.exe"
• Use In (capital I) for list matches: DstPort In (80, 443)
• Use NOT before conditions for negation: NOT DstIP In ("10.0.0.0/8")
• Pipeline operators start with | on a new line or after a space
• Comments are not supported in PowerQuery

Best Practices

1. Use Purple AI to generate queries - Do not write PowerQuery manually unless you are familiar with the syntax
2. Always set a time range - Avoid scanning the entire Data Lake; default to 24 hours
3. Start narrow, then broaden - Begin with specific filters and widen if no results
4. Use the columns operator - Select only the fields you need for faster results
5. Limit results - Always include | limit 100 to stay within the row limit
6. Check for empty results - Empty results are valid; they mean no matching data
7. Iterate on findings - Use initial results to refine follow-up queries
8. Filter by site - Add SiteName = "Client Name" to scope hunts to specific clients
9. Combine with alerts - Cross-reference PowerQuery findings with alert data
10. Document queries - Save successful hunting queries for reuse across client environments

Related Skills

• Purple AI - Generate PowerQuery strings from natural language
• Alerts - Alert context for threat hunting findings
• API Patterns - MCP tools reference and connection info
• Inventory - Asset context for endpoints in query results
• Vulnerabilities - Vulnerability context for compromised endpoints