SentinelOne Singularity — content authoring

Critical naming caveat: "SentinelOne" is the vendor; "Sentinel" is the SentinelOne sensor product. This is distinct from Microsoft Sentinel (a SIEM). Detection content for SentinelOne goes into configurations.sentinel_one — never configurations.sentinel.

This skill encodes operational context for SentinelOne Singularity content authoring. The platform spans the on-sensor AI Engine (vendor-managed behavioural detection), STAR Custom Logic (customer-authored behavioural rules), Deep Visibility (event search), and Singularity Data Lake / PowerQuery (multi-source SIEM-like analytics).

1. Surface identification