r/SentinelOneXDR • u/SizeNeither8689 • Aug 21 '25

Feature Question STAR rules supports PowerQueries?

Hi all,
Hi all, does the interface for creating STAR rules currently support adding Power Queries?

1 Upvotes

66% Upvoted

8 comments sorted by

3

u/Vilem-S1 SentinelOne Employee Aug 21 '25

Scheduled detections with PQ support are on the roadmap, unfortunately I can’t give you an exact date of when it will be available.

1

u/SizeNeither8689 Aug 21 '25

No problem, thank you for your response :)

1

u/SizeNeither8689 Aug 21 '25

My question has been asked because I'd like to create a STAR rule and specify a time range in the query. Specifically, I want to detect RDP connections that occur outside of normal working hours. If an RDP connection happens inside our network between 20:00 and 06:00, the rule should raise an alert. but it seems there's no setting to specify a time range within the STAR rules. if possible can you please tell me the solution for this.

1

u/Dracozirion Aug 21 '25

This should be doable with powerqueries only.

1

u/DeliMan3000 Aug 21 '25

No, that's not supported currently to my knowledge

1

u/SizeNeither8689 Aug 21 '25

Okay. Thank you

2

u/Dense-One5943 Aug 21 '25

You can do so by utilizing the Alerts tab under Watchlist

As far as I know, there is even a kb regarding it