s1-secops-skills v1.3.0 + s1-secops-mcp 1.3.1: single-credential SDL auth, Hyperautomation integration catalog by pmoses-s1 · Pull Request #86 · Sentinel-One/ai-siem

pmoses-s1 · 2026-08-07T01:29:18Z

Credentials: Removed the need for the XDR URL/SDL Log & Config API Keys by using new GraphQL Console APIs

The console API token authorises every SDL operation. Verified live against a production tenant with only the reduced set exposed, then verified again that the scoped keys pass on exactly the same calls, so they add nothing but rotation overhead.

Removed entirely, no longer read anywhere:

SDL_CONFIG_READ_KEY, SDL_CONFIG_WRITE_KEY, SDL_LOG_READ_KEY, SDL_LOG_WRITE_KEY
SDL_XDR_URL — the SDL base is now derived from S1_CONSOLE_URL as <console>/sdl. POST <console>/sdl/api/* returns results identical to the regional XDR host (1,914 config paths either way), so the separate host was redundant.

Not needed in claude_desktop_config.json when running through the s1-mcps image: PURPLEMCP_CONSOLE_BASE_URL and PURPLEMCP_CONSOLE_TOKEN. The entrypoint derives them from S1_CONSOLE_URL and S1_CONSOLE_API_TOKEN, so purple-mcp takes the same two variable names as s1-secops-mcp. Verified live: purple-mcp initialises inside the image with only those two set. A server-specific variable that is already set always wins, so existing configurations keep working.

Running purple-mcp directly via uvx bypasses the entrypoint, so that install path still needs PURPLEMCP_*.

VIRUSTOTAL_API_KEY is unchanged.

Minimum credential set is now S1_CONSOLE_URL, S1_CONSOLE_API_TOKEN, and S1_HEC_INGEST_URL for ingest, plus VIRUSTOTAL_API_KEY if you run virustotal-mcp.

Code

lib/sdl.js: keyCandidates() and the per-chain 401/403 fallthrough are replaced by sdlToken(); sdlFetch drops its chain argument. A 403 is now raised on the first request rather than silently retried against a second credential.
sdl_client.py: KEY_CHAINS, _candidate_keys() and _pick_key() removed. _auth_headers() builds one Bearer header and the client fails fast at construction when the token is absent.
SDLClient.keys no longer exists. The c.keys["log_read_key"] = "" force-clear idiom raises AttributeError, so it has been removed from every skill, doc and CLAUDE.md. This is the one change that will break copied snippets: delete those lines, nothing replaces them.
MCP 1.2.4 -> 1.3.1, npm package @pmoses-s1/s1-secops-mcp, Docker image 1.3.1.

Skills

hyperautomation gains references/integration-catalog.md: the 62 built-in and 52 custom integrations resolved live, with all 266 packaged actions (public_action_id, method, path) grouped by integration. The skill previously documented action types but had no way to answer "what can this integration do", so it hand-rolled URLs instead of selecting a packaged action. Mined from 1,205 production workflows / 17,899 action steps.

Also in that skill: the native llm action now has a schema (it was referenced in prose but never defined), the action-type table is corrected from 17 to 19 types, and the SQL action is recorded as a known gap — S-26.2 documents it, it appears in zero sampled workflows, so its JSON type string is unverified and deliberately not guessed. Marco Rottigni is credited as co-author.

Breaking

Anything defining the four scoped SDL keys or SDL_XDR_URL is unaffected; the values are simply ignored.
SDLClient.keys removal, as above.

Verification

Live against a production tenant with only S1_CONSOLE_URL and S1_CONSOLE_API_TOKEN exposed:

data source enumeration: 27 sources
per-source attribute discovery: 27/27 sources, 843 distinct fields
parser lifecycle 12/12: create, read, list, update with expectedVersion, stale-version rejection, delete, verify absent
sdl-api/tests/smoke_test.py 12/12
MCP tools/list 26 tools; config-file CRUD green

Repo checks: Node suite 57/57, markdownlint, shellcheck and shfmt clean, no new broken links (the 18 pre-existing ones in mcp/docker/README.md, mcp/s1-secops-mcp/deploy/README.md and workflows/** are untouched), no dangling symlinks. Plugin rebuilt at 1.3.0.

Syncs the hyperautomation skill from claude-skills v1.2.17. New: skills/hyperautomation/references/integration-catalog.md. The 62 built-in and 52 custom Hyperautomation integrations resolved from a production tenant, with all 266 packaged actions (public_action_id, method, path) grouped by integration, plus the ad-hoc call shapes seen against each. The skill previously documented action types but had no way to answer "what can this integration do", so it hand-rolled URLs instead of picking a packaged action. Mined from 1,205 exported workflows / 17,899 action steps, cross-checked against 39 workflows on six further tenants. Also in the skill: - Document the native `llm` action in building-blocks.md. It was referenced in prose but never given a schema; response_format and json_schema appeared nowhere in the skill. - Correct the action-type prevalence table: 19 types, not 17. Adds `llm` and `snippet_20`, and refreshes counts from the 1,205-workflow corpus. - Record the SQL action as a known gap. S-26.2 documents it; it appears in zero sampled workflows, so its JSON type string is unverified and not guessed. - Note that integration action packs are not queryable: GET /integrations is 405, /integrations/{id}/actions is 404, and enumeration only works via /connections/scope. - README: list building-blocks-catalog.md (never listed) and the new catalog, and add a Coverage and known gaps section. Build fix: scripts/build.sh now drops superseded s1-secops-skills-v*.plugin files from dist/ on every build. Without it this bump left v1.2.16 sitting next to v1.2.17. This ports claude-skills ed51841, which fixed the same bug there. Plugin 1.2.16 -> 1.2.17, dist rebuilt.

…auth Syncs claude-skills. Supersedes the v1.2.17 content on this branch. Credentials, seven variables reduce to three: - The console API token authorises every SDL operation. SDL_CONFIG_READ_KEY, SDL_CONFIG_WRITE_KEY, SDL_LOG_READ_KEY and SDL_LOG_WRITE_KEY are no longer read anywhere. - SDL_XDR_URL removed. The SDL base is derived from S1_CONSOLE_URL as <console>/sdl. Verified live: <console>/sdl/api/* returns results identical to the regional XDR host. - The image entrypoint derives PURPLEMCP_CONSOLE_BASE_URL, PURPLEMCP_CONSOLE_TOKEN and VIRUSTOTAL_API_KEY from the canonical S1_* names, so all three bundled servers are configured with one set of names. Code: - lib/sdl.js: keyCandidates() and the per-chain 401/403 fallthrough replaced by sdlToken(); sdlFetch drops the chain argument. A 403 is raised on the first request rather than retried against a second credential. - sdl_client.py: KEY_CHAINS, _candidate_keys() and _pick_key() removed; _auth_headers() builds one Bearer header; the client fails fast at construction when the token is absent. SDLClient.keys no longer exists, so the c.keys["log_read_key"] = "" force-clear idiom is gone from every skill, doc and CLAUDE.md. - MCP 1.2.4 -> 1.3.1, npm package @pmoses-s1/s1-secops-mcp, Docker image 1.3.1. Skills: - hyperautomation: new references/integration-catalog.md, the 62 built-in and 52 custom integrations with all 266 packaged actions (public_action_id, method, path), mined from 1,205 production workflows. Documents the native llm action, corrects the action-type table to 19 types, and records the SQL action as a known gap. Marco Rottigni credited as co-author. Verified live with only S1_CONSOLE_URL and S1_CONSOLE_API_TOKEN exposed: 27 data sources enumerated, per-source schema discovery 27/27 (843 distinct fields), parser lifecycle 12/12 including stale-version rejection, sdl-api smoke_test.py 12/12, MCP tools/list 26. Node suite 57/57. markdownlint, shellcheck and shfmt clean. No new broken links, no dangling symlinks. Plugin rebuilt at 1.3.0.

getCreds() read VT_API_KEY but nothing consumed it, and this MCP exposes no VirusTotal tools. Behaviourally a no-op.

marcorottigni-s1

approved

…e console host Follow-up to #86. - docs/installation.md and docs/vm-deployment.md configured purple-mcp with PURPLEMCP_CONSOLE_TOKEN / PURPLEMCP_CONSOLE_BASE_URL. The image entrypoint derives both from S1_CONSOLE_URL and S1_CONSOLE_API_TOKEN, so the examples now use the canonical two. Verified live against the 1.3.1 image. - README advertised :1.2.3 bundling s1-secops-mcp 1.2.2; now :1.3.1 / 1.3.1. - sdl-api, sdl-dashboard and the RBA workflow template still described the SDL REST endpoints as living on xdr.us1; they are reachable at <console>/sdl/api/* with identical results. Left alone: the LRQ docs that name xdr.us1 to warn against it, the V1 deprecation notices, and the hyperautomation catalogs where the host is mined corpus data. Plugin rebuilt at 1.3.0.

pmoses-s1 added 2 commits August 6, 2026 18:28

pmoses-s1 changed the title ~~s1-secops-skills v1.2.17: Hyperautomation integration action catalog~~ s1-secops-skills v1.3.0 + s1-secops-mcp 1.3.1: single-credential SDL auth, Hyperautomation integration catalog Aug 7, 2026

pmoses-s1 added 4 commits August 6, 2026 23:49

credentials: drop the vestigial VT_API_KEY field

a004d49

getCreds() read VT_API_KEY but nothing consumed it, and this MCP exposes no VirusTotal tools. Behaviourally a no-op.

docs: add the 1.3.x upgrade guide

69a5d57

docs: SDL REST lives under <console>/sdl

2248643

docs: restore the anchored README link depth after re-sync

738652d

marcorottigni-s1 approved these changes Aug 7, 2026

View reviewed changes

marcorottigni-s1 merged commit b16191e into Sentinel-One:main Aug 7, 2026
2 checks passed

pmoses-s1 mentioned this pull request Aug 7, 2026

docs: purple-mcp uses the canonical S1_* variables; SDL REST is on the console host #87

Merged

Navigation Menu

Uh oh!

s1-secops-skills v1.3.0 + s1-secops-mcp 1.3.1: single-credential SDL auth, Hyperautomation integration catalog - #86

s1-secops-skills v1.3.0 + s1-secops-mcp 1.3.1: single-credential SDL auth, Hyperautomation integration catalog#86
marcorottigni-s1 merged 6 commits into
Sentinel-One:mainfrom
pmoses-s1:data-se/sync-claude-skills-v1.2.17

pmoses-s1 commented Aug 7, 2026 •

edited

Loading

Uh oh!

marcorottigni-s1 left a comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Conversation

pmoses-s1 commented Aug 7, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Credentials: Removed the need for the XDR URL/SDL Log & Config API Keys by using new GraphQL Console APIs

Code

Skills

Breaking

Verification

Uh oh!

marcorottigni-s1 left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

pmoses-s1 commented Aug 7, 2026 •

edited

Loading