Merge pull request #72 from pmoses-s1/feat/sdl-solutions-detection-as-code

sdl-solutions: Detection as Code (s1-secops-skills v1.2.5)

Author: jham-s1

.claude-plugin/marketplace.json

@@ -13,8 +13,8 @@
     {
       "name": "s1-secops-skills",
       "source": "./plugins/s1-secops-skills",
-      "description": "SentinelOne SecOps skills for Claude: PowerQuery threat hunting, Management Console API, Singularity Data Lake API, SDL dashboard authoring, SDL log parsing, Hyperautomation workflow generation, source-agnostic behavioral baselining with z-score anomaly detection, and packaged SDL solution deployment (data source onboarding to OCSF with device/user enrichment, dashboard, MITRE-mapped detections and a threat-response flow; plus asset enrichment of raw logs).",
-      "version": "1.2.4",
+      "description": "SentinelOne SecOps skills for Claude: PowerQuery threat hunting and STAR/Custom Detection rules; Management Console API; Singularity Data Lake API; SDL dashboards; log parsing (OCSF); Hyperautomation SOAR; z-score anomaly baselining; autonomous DFIR alert investigation (soc-investigator); and one-prompt SDL solutions: source onboarding, asset enrichment, UEBA, ingest health, detection exclusions, Risk-Based Alerting, alert noise reduction, and Detection as Code.",
+      "version": "1.2.7",
       "author": {
         "name": "Prithvi Moses",
         "email": "prithvi.moses@sentinelone.com"
@@ -33,8 +33,11 @@
         "ocsf",
         "dashboards",
         "detections",
-        "threat-hunting"
+        "threat-hunting",
+        "dfir",
+        "incident-response",
+        "investigation"
       ]
     }
   ]
-}
+}

CHANGELOG.md

@@ -7,6 +7,18 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+### Added - soc-investigator skill + sdl-solutions: Alert noise reduction (s1-secops-skills v1.2.6)
+
+- New **soc-investigator** skill: autonomous, staged DFIR investigation of SentinelOne alerts (SHORT/MEDIUM/LONG modes) with tool discovery, interactive intake, IOC enrichment, per-endpoint PowerQuery forensics, and optional third-party correlation and anomaly detection. Carries the evidence-discipline and verdict gates from the SOC Analyst standard and the SDL threat-hunt-and-correlation method (`references/evidence-and-verdict-discipline.md`, `references/correlation-and-hunt-methodology.md`). Authored by Joel Mora.
+- New `sdl-solutions` solution **Alert noise reduction**: find the sources and signatures flooding the alert queue, separate ingested and already-actioned noise from real detections, recommend an ingestion-severity filter, auto-resolve already-mitigated alerts with a note, and ship a noise-vs-signal dashboard. Adds `references/alert-noise-reduction.md`, `assets/alertnoise_dashboard.template.json`, `assets/alertnoise_autoresolve_ha.template.json`, and `docs/solutions/alert-noise-reduction.md`.
+- Plugin version bumped to **1.2.6** (`.claude-plugin/plugin.json`, marketplace entry) and rebuilt bundles in `dist/`.
+
+### Added - sdl-solutions: Detection as Code (s1-secops-skills v1.2.5)
+
+- New `sdl-solutions` solution **Detection as Code (DaC)**: stand up a Git + CI pipeline where detection engineers author rules as TOML, a pull request triggers validation and four-eyes review, and a merge syncs the changed rules to the SentinelOne Custom Detection Rule API. Supports all three rule types (single-event `events`, multi-event `correlation`, and scheduled PowerQuery). Adds `references/detection-as-code.md`, the `assets/detection-as-code-starter/` repo scaffold (a zero-dependency `dac_sync.py` TOML-to-API validate/convert/idempotent-sync engine, `dac_lint.py`, `rule.schema.json`, working TOML examples per rule type, `.github/workflows/{lint,sync}.yml`, `CODEOWNERS`, and GitLab/Azure CI equivalents), and `docs/solutions/detection-as-code.md`.
+- `mgmt-console-api`: corrected the Custom Detection Rule type table, `queryType: "correlation"` requires `queryLang: "2.0"` (confirmed live; without it the POST returns HTTP 400 `query lang must be 2.0`). Only single-event `events` rules use 1.0.
+- Plugin version bumped to **1.2.5** (`.claude-plugin/plugin.json`, marketplace entry) and rebuilt bundles in `dist/`.
+
 ### Added - sdl-solutions: scheduled detection exclusions (s1-secops-skills v1.2.2)
 
 - New `sdl-solutions` solution **scheduled detection exclusions**: suppress known-good noise in a scheduled detection over a third-party source by keying it against a CSV exclusion list (assets by IP/CIDR/host, or custom domains/users/values) loaded as an SDL lookup and applied with a lookup anti-join, plus an exclusion-effectiveness dashboard. CIDR/wildcard matches (which the STAR rule validator rejects) run via a Hyperautomation flow that posts a self-contained OCSF S1 SecurityAlert (`class_uid 99602001`) to UAM. Adds `references/scheduled-detection-exclusions.md`, six `assets/exclusion_*` templates, and `docs/solutions/scheduled-detection-exclusions.md`.

mcp/docker/README.md

@@ -28,12 +28,14 @@ When bumping a pin, edit both. They are checked once via `grep` in CI; a mismatc
 
 | What | Source | Current pin |
 |---|---|---|
-| Image version (`IMAGE_VERSION`) | this repo | `1.2.2` |
+| Image version (`IMAGE_VERSION`) | this repo | `1.2.3` |
 | `@pmoses-s1/sentinelone-mcp` | npm | `1.2.2` |
 | `@burtthecoder/mcp-virustotal` | npm | `1.0.21` |
-| `purple-mcp` | git | `1582c094` (Sentinel-One/purple-mcp main) |
+| `purple-mcp` | git | `07d4992` (Sentinel-One/purple-mcp `v0.7.0`, 2026-06-26) |
 
-`IMAGE_VERSION` is the tag the image is published under (`ghcr.io/pmoses-s1/s1-mcps:1.2.2`). It is independent of the underlying MCP versions: bump it when the Dockerfile, dispatcher, or bundled CLAUDE.md changes, even if all three MCP pins stay the same.
+`purple-mcp` is pinned to the `v0.7.0` release commit rather than a floating `main`, per upstream security guidance. When a newer release ships, repin here and in `mcp/docker/build.sh`.
+
+`IMAGE_VERSION` is the tag the image is published under (`ghcr.io/pmoses-s1/s1-mcps:1.2.3`). It is independent of the underlying MCP versions: bump it when the Dockerfile, dispatcher, or bundled CLAUDE.md changes, even if all three MCP pins stay the same.
 
 ## Build locally
 
@@ -42,9 +44,9 @@ When bumping a pin, edit both. They are checked once via `grep` in CI; a mismatc
 docker/build.sh
 
 # Smoke test
-docker run -i --rm s1-mcps:1.2.2 help
+docker run -i --rm s1-mcps:1.2.3 help
 echo '{"jsonrpc":"2.0","id":1,"method":"initialize","params":{"protocolVersion":"2024-11-05","capabilities":{},"clientInfo":{"name":"smoke","version":"0.1"}}}' \
-  | docker run -i --rm s1-mcps:1.2.2 sentinelone-mcp
+  | docker run -i --rm s1-mcps:1.2.3 s1-secops-mcp
 ```
 
 The dispatcher accepts `sentinelone-mcp`, `purple-mcp`, `virustotal-mcp`, or `help`.

mcp/docker/build.sh

@@ -18,13 +18,15 @@ set -euo pipefail
 # The version of THIS image. Independent of the underlying MCP versions
 # below, bump this when the image content (Dockerfile, dispatcher, bundled
 # CLAUDE.md) changes, even if all three MCP pins stay the same.
-IMAGE_VERSION="${IMAGE_VERSION:-1.2.2}"
+IMAGE_VERSION="${IMAGE_VERSION:-1.2.3}"
 
 # ── Pinned MCP versions ──────────────────────────────────────────────────────
 S1_MCP_VERSION="${S1_MCP_VERSION:-1.2.2}"
 VT_MCP_PACKAGE="${VT_MCP_PACKAGE:-@burtthecoder/mcp-virustotal}"
 VT_MCP_VERSION="${VT_MCP_VERSION:-1.0.21}"
-PURPLE_MCP_REF="${PURPLE_MCP_REF:-1582c0945101d0da2a158e66d8c329f66f251f27}"
+# purple-mcp v0.7.0 (2026-06-26). Pinned to the release commit, not a floating
+# branch, per upstream security guidance. Keep in sync with mcp/docker/README.md.
+PURPLE_MCP_REF="${PURPLE_MCP_REF:-07d4992089b10affff6163f296b1f6cb5734539f}"
 
 # ── Image identity ───────────────────────────────────────────────────────────
 REGISTRY="${REGISTRY:-ghcr.io/pmoses-s1}"

mcp/docker/entrypoint.sh

@@ -5,7 +5,7 @@
 set -e
 
 case "${1:-help}" in
-  sentinelone-mcp|s1)
+  s1-secops-mcp|sentinelone-mcp|s1)
     exec sentinelone-mcp
     ;;
   purple-mcp|purple)
@@ -19,21 +19,21 @@ case "${1:-help}" in
 SentinelOne Claude Skills MCP Stack
 
 Bundled servers (select one per `docker run`):
-  sentinelone-mcp   PowerQuery, SDL, Mgmt Console REST, UAM, Hyperautomation
+  s1-secops-mcp    PowerQuery, SDL, Mgmt Console REST, UAM, Hyperautomation
   purple-mcp        Alert triage, Purple AI NLQ, Deep Visibility, assets, vulnerabilities
   virustotal-mcp    External IOC enrichment
 
 Usage:
   docker run -i --rm -e S1_CONSOLE_URL -e S1_CONSOLE_API_TOKEN ... \
-    ghcr.io/pmoses-s1/s1-mcps:latest sentinelone-mcp
+    ghcr.io/pmoses-s1/s1-mcps:latest s1-secops-mcp
 
 Reference:
   https://github.com/Sentinel-One/ai-siem/blob/main/plugins/s1-secops-skills/docs/docker.md
 EOF
     ;;
   *)
     echo "entrypoint: unknown command '$1'" >&2
-    echo "valid: sentinelone-mcp, purple-mcp, virustotal-mcp, help" >&2
+    echo "valid: s1-secops-mcp, purple-mcp, virustotal-mcp, help" >&2
     exit 64
     ;;
 esac

plugins/s1-secops-skills/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "s1-secops-skills",
-  "version": "1.2.4",
-  "description": "SentinelOne SecOps skills for Claude: PowerQuery threat hunting, Management Console API, Singularity Data Lake API, SDL dashboard authoring, SDL log parsing, Hyperautomation workflow generation, source-agnostic behavioral baselining with z-score anomaly detection, and packaged SDL solution deployment (data source onboarding to OCSF with device/user enrichment, dashboard, MITRE-mapped detections and a threat-response flow; plus asset enrichment of raw logs).",
+  "version": "1.2.7",
+  "description": "SentinelOne SecOps skills for Claude: PowerQuery threat hunting and STAR/Custom Detection rules; Management Console API; Singularity Data Lake API; SDL dashboards; log parsing (OCSF); Hyperautomation SOAR; z-score anomaly baselining; autonomous DFIR alert investigation (soc-investigator); and one-prompt SDL solutions: source onboarding, asset enrichment, UEBA, ingest health, detection exclusions, Risk-Based Alerting, alert noise reduction, and Detection as Code.",
   "author": {
     "name": "Prithvi Moses",
     "email": "prithvi.moses@sentinelone.com"
@@ -22,7 +22,12 @@
     "asset-enrichment",
     "onboarding",
     "ocsf",
-    "solutions"
+    "solutions",
+    "detection-as-code",
+    "dac",
+    "dfir",
+    "incident-response",
+    "investigation"
   ],
   "hooks": {
     "SessionStart": [
@@ -38,4 +43,4 @@
   },
   "license": "AGPL-3.0",
   "homepage": "https://github.com/Sentinel-One/ai-siem"
-}
+}