Mick 2c40bf81ee Cherry-pick improvements from PR #2 (marcredhat) ...

- s1_client: configurable PowerQuery timeout via SDL_PQ_TIMEOUT env var
  (default 600s, was hardcoded 120s) with separate connect/read timeouts
  via httpx.Timeout; retry on ReadTimeout via SDL_PQ_TIMEOUT_RETRIES;
  better error messages include query snippet and parse non-JSON responses
- ingest: fix simulate-filter SDL syntax (== → =, drop leading | on base
  expression, surface PowerQuery error field, cleaner empty-filter fallback)
- docker-compose: pass SDL_PQ_TIMEOUT and SDL_PQ_TIMEOUT_RETRIES through
  to backend container with sensible defaults

Not taken from PR #2:
- .gitignore parsers/* change — would untrack the 7 committed parser files
- s1_client/quality/coverage changes already present in main from prior work

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

2026-05-22 10:11:42 -04:00

..

__init__.py

Initial commit: SIEM Toolkit for SentinelOne

2026-05-19 11:39:26 -04:00

rule_parser.py

Initial commit: SIEM Toolkit for SentinelOne

2026-05-19 11:39:26 -04:00

s1_client.py

Cherry-pick improvements from PR #2 (marcredhat)

2026-05-22 10:11:42 -04:00