Purple AI
SentinelOne · Purple AI: SentinelOne's Agentic SOC Analyst That Triages, Investigates and Responds to Alerts Inside Singularity
Purple AI is SentinelOne's agentic security analyst: it turns plain-language questions into threat hunts, triages alerts, runs end-to-end investigations that reach a verdict with evidence, and can hand that verdict to Singularity Hyperautomation for a policy-bound response. It is for SOC teams that already run, or are buying, the SentinelOne Singularity Platform; it is not sold as a standalone tool.
Best for
SOC teams that run SentinelOne Singularity (or are consolidating on it, with AI SIEM for third-party data) and want alerts triaged and investigated to a verdict automatically, with response actions gated by policies they set
Not ideal for
Organizations whose EDR and SIEM come from other vendors, small teams that want a self-serve tool with published pricing, and teams that need to run the AI on models they host themselves
Who it's for
SOC analysts, incident responders, threat hunters and security leaders at organizations that run the SentinelOne Singularity Platform
Capabilities
- Natural-language threat hunting: translates a plain-language question into a structured query, runs it across native and partner data, summarizes the results and suggests follow-up questions
- Agentic Investigation that takes an alert end to end, gathering cross-stack evidence, building an attack timeline and returning a verdict with recommended next actions
- Investigations can start automatically when an alert crosses a defined threshold, or with one click from the console
- Verdict Justification that explains why Purple AI reached each verdict
- Auto-Triage, Similarity Analysis and Community Verdict to rank which alerts need attention first
- Investigation Notebooks that record and share the queries, findings and decisions of an investigation, plus AI-generated summaries
- Reasons over OCSF-normalized data from native SentinelOne telemetry (endpoint, cloud, identity) and integrated third-party sources
- Closed-loop response through Singularity Hyperautomation: trigger an investigation from any workflow step, pull the verdict and evidence into the workflow, apply LLM Actions and call reusable response snippets
- Automated actions run only within pre-approved policies, with role-based activation, adjustable human-in-the-loop settings and every action logged
- Open-source (MIT) Purple AI MCP Server that gives MCP clients and custom agents read-only access to Purple AI, PowerQuery events, alerts, vulnerabilities, misconfigurations, inventory and (with your own VirusTotal API key) threat-intelligence lookups
Limitations
- Only available inside the SentinelOne Singularity Platform; there is no standalone Purple AI product
- SentinelOne's packages page does not name Purple AI: it lists an "Agentic AI SOC Analyst" as an add-on for Singularity Complete and Commercial and included in Singularity Enterprise (no published price), plus a separate "AI Security Assistant" included in all three, so confirm with SentinelOne or a partner which Purple AI capabilities your tier includes
- Agentic Investigation started as a complimentary trial; after it, usage is paid for with Singularity Credits, and no per-investigation credit cost is published
- Coverage of non-SentinelOne tools depends on which third-party sources you ingest into the SentinelOne data lake (for example through AI SIEM and AI Data Pipelines)
- The Purple AI MCP Server is read-only, works with one Account or Site per server instance, and has no built-in authentication, so network-exposed deployments need a reverse proxy
- Autonomous response runs through Singularity Hyperautomation workflows, which teams must design and govern; in August 2026 SentinelOne said the Agentic Investigation workflow capabilities were expected to be generally available later that quarter, and no general-availability announcement was found
- SentinelOne publishes no list of supported languages or regional availability for Purple AI on its product page
Use cases
- Asking "which endpoints talked to this domain in the last 7 days?" in plain language instead of writing a query
- Letting Purple AI investigate every critical alert overnight and over the weekend, so analysts start the day with verdicts and evidence rather than a queue
- Feeding a Purple AI verdict into a Hyperautomation workflow that runs a pre-built containment snippet only when the team's pre-approved conditions are met
- Bringing junior analysts up to speed with guided investigations and shared Investigation Notebooks written by senior staff
- Investigating an alert that spans endpoint, identity and third-party firewall or email data without switching consoles
- Querying SentinelOne alerts and inventory from Claude Code or a custom agent through the read-only Purple AI MCP Server
Our take
Purple AI is worth evaluating if SentinelOne is already your endpoint or SIEM vendor, because its value comes from investigating on data the platform already holds; for a team on another EDR it is a platform decision, not an add-on. The useful shift in 2026 is from a hunting assistant to an investigator: alerts can be worked to a verdict with evidence on nights and weekends, and Hyperautomation can act on that verdict within limits you set. Start with investigations that recommend actions, check how often the verdicts hold up against your analysts' calls, and move only well-understood response snippets to automatic execution. Before buying, get in writing whether Purple AI is an add-on or included at your tier and how many Singularity Credits a typical month of Agentic Investigation consumes, since neither is published.
Who should use it
SentinelOne Singularity customers, especially those with AI SIEM ingesting third-party data, whose SOC cannot keep up with alert volume and who want investigations and documentation done automatically with response kept under policy control.
Who should skip it
Teams standardized on another vendor's EDR and SIEM, small IT teams without a SOC function, buyers who need published pricing or predictable per-seat costs, and anyone who needs to host the underlying models themselves.
Strengths
- Investigates alerts end to end and explains each verdict, rather than only answering questions in a chat
- Works on data already in the Singularity Platform, normalized to OCSF, including third-party sources you ingest
- Autonomous response is bounded by pre-approved policies, role-based activation and adjustable human-in-the-loop settings, with every action logged
- Investigation Notebooks keep a shareable record of how an investigation was run
- SentinelOne says customer data is never used to train its models and cites FedRAMP High support
- Open-source, read-only MCP server for bringing SentinelOne data into your own agents
Weaknesses
- Tied to the SentinelOne platform; of little use if your EDR and SIEM come from elsewhere
- No published price for Purple AI, and the packages page lists the agentic SOC analyst as an add-on below Singularity Enterprise
- Agentic Investigation draws on Singularity Credits after the trial, which makes cost harder to predict
- Automated response depends on building and maintaining Hyperautomation workflows
Purple AI pricing
Singularity Complete or Commercial + Agentic AI SOC Analyst add-on
Contact sales
- Agentic AI SOC Analyst listed as an add-on on both packages; add-on price not published
- Base packages listed at $179.99 (Complete) or $229.99 (Commercial) per endpoint per year, for 5 to 100 workstations
- Commercial adds identity detection and response, 90-day data retention and managed threat hunting
Singularity Enterprise
Contact sales
- Agentic AI SOC Analyst included
- Full visibility and forensics, network data collection
- Expert-led onboarding and training
Singularity Credits
Usage-based
- Pays for Agentic Investigation and other AI-powered work after the complimentary trial; no credit price published
- Bought through partners, direct billing or eCommerce
- Administrator-set consumption guardrails
Note: SentinelOne does not publish a price for Purple AI or for Singularity Credits. The packages page lists an "Agentic AI SOC Analyst" (the role SentinelOne's Purple AI page describes) as an add-on for Complete and Commercial and included in Enterprise; it also lists a separate "AI Security Assistant" on Complete, Commercial and Enterprise without saying how it relates to Purple AI. Listed prices are in US dollars for 5 to 100 workstations, and all purchases go through an authorized partner.
Technical specs
Available models
Where Purple AI excels
After-hours alert coverage
Agentic Investigation can start on its own when an alert crosses a threshold, so critical alerts raised at night or over a weekend are investigated to a verdict with evidence before analysts are back.
Query-free threat hunting
Analysts who do not know the query language can ask questions in plain language, get summarized results and suggested follow-ups, and save the hunt in a notebook their colleagues can reuse.
Policy-gated containment
A Hyperautomation workflow can pull the Purple AI verdict and evidence and run a pre-built response snippet only when the team's conditions are met, with every action logged for review.
How Purple AI fits alongside other tools
Purple AI and Axonius AI Workforce
Axonius AI Workforce works on an asset and exposure inventory, triaging vulnerabilities and coverage gaps and opening tickets. Purple AI works in the SOC on alerts and telemetry, investigating detections to a verdict and triggering response. One reduces exposure before an attack; the other handles what the detection stack flags.
Purple AI and Claude Code
Claude Code is a general coding and terminal agent. With SentinelOne's read-only Purple AI MCP Server, it can query Purple AI, alerts and inventory, which suits engineers building custom detections or reports. Investigations, verdicts and automated response still run inside Purple AI and Hyperautomation.
Frequently asked questions
What is Purple AI?
Purple AI is SentinelOne's agentic AI security analyst, built into the Singularity Platform. It answers threat-hunting questions asked in plain language, helps triage alerts, investigates alerts end to end to reach an explained verdict, and can pass that verdict to Singularity Hyperautomation to run a response within policies the team has approved.
Is Purple AI the same as Singularity ASOC?
No. Singularity ASOC, announced at OneCon on October 21, 2026, is a suite that SentinelOne says is powered by Purple. It packages Purple Agentic Investigation with AI SIEM, Hyperautomation, AI Data Pipelines and threat intelligence and IOC management. Purple AI is the AI layer that does the reasoning and investigation inside it.
How much does Purple AI cost?
SentinelOne does not publish a price for Purple AI, and its packages page does not use the Purple AI name. It lists an "Agentic AI SOC Analyst" (the role SentinelOne's Purple AI page describes) as an add-on for Singularity Complete ($179.99 per endpoint per year) and Singularity Commercial ($229.99), and as included in Singularity Enterprise, which is priced through sales. Those list prices are for 5 to 100 workstations and purchases go through authorized partners. A separate "AI Security Assistant" is listed as included in all three packages. Agentic Investigation also uses Singularity Credits once its complimentary trial ends, and no credit price is published.
Can Purple AI take action on its own?
Yes, within limits you set. Agentic Investigation can start automatically when an alert crosses a defined threshold, and its verdict can trigger automated, policy-driven responses through Singularity Hyperautomation or prompt an analyst with recommended actions. SentinelOne says automated actions fire only within pre-approved policies, activation is role-based, human-in-the-loop settings are adjustable, and every action is logged.
Does Purple AI work with data from other security vendors?
Yes, if that data is in the Singularity Platform. Purple AI reasons over OCSF-normalized data from native SentinelOne telemetry and integrated third-party sources. SentinelOne's AI Data Pipelines, part of Singularity ASOC, list more than 50 out-of-the-box connectors to third-party sources, including other security vendors' tools.
Which AI models does Purple AI use?
SentinelOne says Purple AI Agentic Investigation combines Anthropic's Claude, OpenAI's GPT and its own Ultraviolet models, and its product page describes swappable foundation models. SentinelOne also says customer data is never used to train its models.
Can I use Purple AI from Claude or my own agents?
Through the Purple AI MCP Server, an MIT-licensed open-source project from SentinelOne. It works with MCP clients such as Claude Desktop, Claude Code, OpenAI Codex, Pydantic AI and Zed, and lets them ask Purple AI questions and query alerts, PowerQuery events, vulnerabilities, misconfigurations and inventory. It is read-only, needs a SentinelOne console token scoped to a single Account or Site, and has no built-in authentication, so SentinelOne advises against exposing it on a network without a reverse proxy.
Integrations & fit
About Purple AI
Purple AI lives inside the SentinelOne Singularity Platform and works over the data already there: native endpoint, cloud and identity telemetry plus third-party sources, normalized to the OCSF schema in SentinelOne's data lake. It has three modes of work. As an assistant, an analyst asks a question in plain language, Purple AI translates it into a structured query, runs it across native and partner data, summarizes the results and suggests follow-up questions, and the work is saved in shareable Investigation Notebooks. As a triage layer, Auto-Triage, Similarity Analysis and a Community Verdict (which SentinelOne says is trained on investigations from its Wayfinder managed services) help rank which alerts to look at first. As an agent, Purple AI Agentic Investigation takes an alert, gathers evidence across the stack, builds the timeline and returns a verdict with an explanation (a Verdict Justification). SentinelOne made one-click Auto Investigation generally available for Purple AI customers in March 2026, opened autonomously triggered Agentic Investigation to Singularity customers as a complimentary trial in June 2026 (running on a mix of Anthropic Claude, OpenAI GPT and SentinelOne's own Ultraviolet models), and in August 2026 announced a tie-in with Singularity Hyperautomation (expected to reach general availability that quarter) so a verdict can feed workflow logic and trigger response actions inside limits the team sets in advance. On October 21, 2026, at OneCon, SentinelOne announced Singularity ASOC, an autonomous SOC suite powered by Purple that groups Agentic Investigation with AI SIEM, Hyperautomation, AI Data Pipelines (more than 50 third-party connectors) and threat intelligence; the announcement did not state when the suite is generally available. An open-source, read-only Purple AI MCP Server lets your own agents and MCP clients such as Claude Code query Purple AI, alerts, events and inventory. The tradeoffs: Purple AI only makes sense if SentinelOne is (or will be) your SOC platform, its reach into non-SentinelOne tools depends on which sources you ingest, Agentic Investigation consumes Singularity Credits after the trial, and SentinelOne publishes no price for Purple AI itself.
Updates from Purple AI
At OneCon 2026, SentinelOne announced Singularity ASOC, a suite powered by Purple that runs connected data, agentic investigation and automated response as one loop. The announcement did not give a general-availability date. It groups Purple Agentic Investigation with AI SIEM, Hyperautomation, threat intelligence and IOC management, and AI Data Pipelines with more than 50 third-party connectors, with Singularity Credits and administrator-set guardrails limiting automated actions.
SentinelOne announced that Purple AI and Singularity Hyperautomation can investigate alerts, reach verdicts and execute responses inside boundaries set by the security team. Hyperautomation workflows can trigger an Agentic Investigation from any step, pull in the report with verdict and evidence, apply LLM Actions and call reusable response snippets; SentinelOne said these workflow capabilities were expected to be generally available later that quarter.
SentinelOne opened Purple AI Agentic Investigation to new and existing Singularity customers as a complimentary opt-in trial (credits are consumed but not charged during the trial). Investigations start on their own when a threat crosses a defined threshold and use a mix of Anthropic Claude, OpenAI GPT and SentinelOne's Ultraviolet models. After the trial, usage is paid for with Singularity Credits.
At RSAC 2026, SentinelOne made one-click Auto Investigation generally available to all Purple AI Analyst customers with no extra deployment or configuration, letting analysts launch a full agentic investigation that gathers evidence, builds an attack timeline and returns an explainable verdict.
Are you the founder? Claim this listing →