sdl-solutions

sdl-solutions is a Blue team & detection skill for AI agents, published by Sentinel-One in the ai-siem repository on GitHub. Skillspace rates sdl-solutions C (77/100) and it passed the safety scan; the rating is based on static analysis only.

Deploy packaged, repeatable SentinelOne Singularity Data Lake (SDL) solutions into a site from one prompt. Use when the user wants to onboard, deploy, or roll out a whole SDL solution. Catalog: (1) data source onboarding (raw to OCSF, enrichment, dashboard, MITRE detections, threat response); (2) asset enrichment from the Asset Inventory; (3) UEBA anomaly detection (ten detections incl. PEER-GROUP, security use-case selector, Robust or Standard method); (4) per-device ingest health; (5) detection exclusions; (6) Risk-Based Alerting; (7) Detection as Code (rules as TOML in Git, synced to the Custom Detection API via CI); (8) alert noise reduction (find noisy sources, recommend an ingestion filter, auto-resolve actioned noise, noise-vs-signal dashboard). Triggers: 'onboard a source', 'deploy UEBA/ingest health', 'add a detection exclusion', 'deploy RBA', 'detection as code', 'reduce alert noise', 'alert optimization'. NOT for one-off queries or standalone parser authoring.

Grade

C

Quality

77 / 100

Safety

Passed

GitHub stars

51

Unproven: rated by static analysis only, not yet compared head-to-head.

Our two independent classifiers differ on this skill's category, so treat the placement as provisional.

This rating describes the version of the repository we crawled; it may have changed since, so go by its current files.

Skillspace indexes and rates this skill; it does not host or endorse it. Run third-party skills at your own risk.