Smaller team
Less experienced analysts can follow guided investigations without knowing the platform's query language.
Where the module helps during an attack
Purple AI does not block attacks itself; its main role is faster investigation and decision-making using other modules' data.
| Area | Level |
|---|---|
| Reconnaissance | context |
| Initial access | context |
| Execution and persistence | context |
| Escalation and lateral movement | context |
| Impact | context |
| Investigation and recovery | primary role |
An AI analyst across the platform's data
Purple AI is a generative AI assistant for security teams. It works with data Singularity collects from endpoints, cloud, identities and integrated third-party tools. Data is normalised to the open OCSF schema, enabling questions across sources.
The assistant does not replace analysts. It reduces routine work: finding related events, summarising activity, suggesting next steps and documenting the investigation.
- Natural-language questions instead of manually written queries.
- AI summaries of events and discovered activity.
- Guided investigations for less experienced team members.
- Investigation Notebooks that automatically document investigations.
- Auto-Triage and agentic investigations with recommended actions and explained verdicts.
Investigating with Purple AI
An analyst receives an alert and asks, for example, how a suspicious file reached a workstation and which other devices contain it. Purple AI prepares a search, summarises results and suggests follow-up questions. The analyst can see the data behind the answer.
According to the vendor, agentic investigation performs analysis, presents evidence and recommends actions. Response can connect to Singularity Hyperautomation, but only within approved policies and with an action record.
The vendor states that customer data is not used to train models. We verify processing terms in the contractual documentation for your licence.
The vendor also offers an MCP Server to expose Purple AI data and workflows to an organisation's own AI agents. Such integration requires the same access and data assessment as any other integration.
Benefits for different team roles
Purple AI makes sense where teams already use SentinelOne and actively investigate alerts. Benefits depend on quality data and people who decide how to respond.
Answer quality depends on the data. More relevant sources allow broader questions. We therefore often consider Purple AI alongside Singularity AI SIEM or additional source integrations.
Experienced analyst
Faster threat hunting, summaries and documentation with less manual work.
Security leadership
More consistent investigations and a record of how the team reached its conclusion.
Implementation and operation with APPSEC
We first verify licensing prerequisites and available data sources. We then test your team's typical questions using real alerts.
- Verification of licensing and feature availability for your environment.
- A pilot using your data and agreed scenarios.
- Rules defining which automated actions may run independently and which require approval.
- Analyst and administrator training within the proposal's scope.
What to check before buying
- Licensing prerequisites and the package that includes Purple AI.
- Available platform data sources and their retention periods.
- Data processing terms, console location and your internal AI policy requirements.
- Who approves automated responses and how they are recorded.
- How the pilot will measure value, for example through typical alert investigation time.
- Whether to integrate Purple AI with your own AI tools through MCP Server.
