powerquery
Execute advanced analytics on SentinelOne's Singularity Data Lake to hunt threats and analyze telemetry data using a high-performance query language.
Instructions
Execute advanced PowerQuery analytics on data in SentinelOne's Singularity Data Lake for complex threat hunting and data analysis.
PowerQuery is SentinelOne's high-performance query language for searching, transforming, and aggregating telemetry and log data in the Scalyr and Singularity XDR platforms. It uses a pipeline-based syntax for filtering, grouping, computing, and summarizing large-scale unstructured data. SentinelOne PowerQuery is not the same as Microsoft PowerQuery. It also looks somewhat like Splunk SPL but is not the same language.
IMPORTANT: You should ALWAYS use the purple_ai() tool to generate PowerQueries for this tool based on natural language. It is very unlikely you know how to write PowerQueries yourself.
If a user gives you a specific PowerQuery that wasn't generated by Purple AI, run it EXACTLY as sent. DO NOT modify the user's input, pass it directly to this tool.
Args: query: The PowerQuery string to execute start_datetime: Start time in ISO 8601 format. ISO 8601 is the international standard for datetime representation: YYYY-MM-DDTHH:MM:SS with timezone offset. MUST include timezone offset (Z for UTC or ±HH:MM for local time). Examples: "2024-01-15T10:30:00Z" (UTC/Zulu time), "2024-01-15T10:30:00+05:00" (UTC+5 hours, e.g., Asia/Karachi), "2024-01-15T10:30:00-08:00" (UTC-8 hours, e.g., US Pacific), "2024-01-15T10:30:00.123456+02:00" (with microseconds, UTC+2) end_datetime: End time in ISO 8601 format. Same format requirements as start_datetime. Must be later than start_datetime. Examples: "2024-01-15T11:30:00Z" (UTC), "2024-01-15T11:30:00+05:00" (UTC+5, same timezone as start), "2024-01-15T11:30:00-08:00" (UTC-8, same timezone as start)
Time Range Guidelines:
DEFAULT to a 24-hour search period unless the user specifies a different time range
Use get_timestamp_range(hours=24) to get the last 24 hours
Queries with longer time ranges may take longer to execute or timeout
The query timeout is 5 minutes; if exceeded, reduce the time range or simplify the query
Understanding Results:
Empty results (no data returned) are NORMAL and ACCEPTABLE. This means no records match your query criteria.
Empty results could indicate:
No matching data exists in the specified time range
The query conditions are too restrictive; remove filters to attempt to retrieve more results
The searched activity or behavior simply hasn't occurred
DO NOT repeatedly rephrase or retry queries that legitimately return no results
If you expect results but get none, consider adjusting the time range or query criteria rather than retrying the exact same query
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| query | Yes | ||
| end_datetime | Yes | ||
| start_datetime | Yes |
Output Schema
| Name | Required | Description | Default |
|---|---|---|---|
| result | Yes |