SentinelOne Purple AI

What is SentinelOne Purple AI?

SentinelOne Purple AI is an agentic AI security analyst within SentinelOne's Singularity platform. It lets analysts search and investigate security telemetry in plain English instead of query languages. Purple AI became generally available in September 2025, per SentinelOne partner coverage.

Key capabilities of SentinelOne Purple AI

• Natural language hunting: ask questions in English across security telemetry
• Investigation notebooks: store hunts, pivots and findings as reusable artifacts
• Hunting quickstarts: expert-curated hunting workflows
• Guided investigations: contextual next-step suggestions
• Post-investigation summaries: generates summaries and communication templates
• Singularity integration: works with SentinelOne platform data

How SentinelOne Purple AI works

An analyst asks a question such as suspicious PowerShell activity in the last 24 hours, and Purple AI queries the data and returns a structured answer with recommended next steps. Findings are saved in notebooks that teams can review, share and audit.

Who uses SentinelOne Purple AI?

SOC analysts and threat hunters on SentinelOne use Purple AI to cut time to investigate.

SentinelOne Purple AI pricing

SentinelOne does not publish Purple AI pricing. Contact the vendor or a reseller for a quote.

SentinelOne Purple AI alternatives

Purple AI is compared with Microsoft Security Copilot and CrowdStrike Charlotte AI. Both are AI assistants tied to their vendors' security platforms.