How to Use SentinelOne Purple AI in 2026: Step-by-Step Guide
SentinelOne Purple AI is an AI-powered security analyst that automates threat hunting, alert investigation, and incident response in natural language. Built into the Singularity platform, it runs autonomous investigations and generates remediation scripts.
SentinelOne Purple AI represents the company's vision of autonomous security operations — an AI analyst that can not only answer questions but take action, running investigations and even generating response scripts without analyst direction.
Autonomous Threat Hunting
Purple AI generates threat hunting queries from natural language prompts: "Are there any signs of lateral movement using Mimikatz in the last 7 days?" The AI writes the underlying PowerQuery, executes it across the environment, and returns findings — no query language expertise required. Security teams can run enterprise-wide threat hunts in minutes.
Alert Investigation
Purple AI summarizes every alert with full context: what the alert means, what happened before and after, what process triggered it, what user account was involved, and what the likely attacker objective was. Analysts skip the context-gathering phase and start directly at analysis.
AI-Generated Remediation Scripts
One of Purple AI's distinctive features: it can generate remediation scripts (PowerShell, Bash) appropriate to the specific threat. Rather than searching documentation for "how do I remove this malware," analysts receive a ready-to-execute script with explanation. The scripts are environment-specific, considering affected OS and configuration.
Natural Language to Singularity Query
Purple AI translates natural language questions into SentinelOne's query language. Security teams without formal training can investigate incidents using plain English while Purple AI handles the technical syntax.
Autonomous Investigation (AI-SOC)
SentinelOne's AI-SOC capability extends Purple AI into autonomous mode — alerts are triaged, investigated, and correlated automatically, with only confirmed threats escalated to analysts. This addresses analyst alert fatigue by dramatically reducing the volume of manual triage work.
Pricing
Purple AI is an add-on to SentinelOne Singularity Enterprise. Enterprise pricing — contact SentinelOne for a quote.
What You'll Need
- A SentinelOne Purple AI account (starting from Contact for pricing)
- A modern web browser or the SentinelOne Purple AI app
- Payment method for paid features
Getting Started
Create Your Account
Visit https://www.sentinelone.com/platform/purple-ai/ and sign up for a enterprise account. You'll need an email address to register.
Start Your First Conversation
Once logged in, you'll see the main chat interface. Type a question or task in the input box and press Enter. SentinelOne Purple AI supports threat-hunting, alert-investigation, autonomous-response, natural-language-security, script-generation, ai-soc — start with a simple text prompt to get familiar.
Pro Tips
- Be specific: The more context you provide, the better the response. Instead of "write an email," try "write a professional follow-up email to a client who hasn't responded in two weeks."
- Iterate: If you don't get what you need, ask for clarification or refinement: "Make it shorter" or "Use a more formal tone."
- Use examples: Show SentinelOne Purple AI what format you want by including an example in your prompt.
- Save useful conversations: Most platforms let you name and revisit conversations — organize by project or topic.
Common Use Cases
Research & Analysis
Chatbots that help with data analysis, literature review, and in-depth research tasks.
Browse Research & Analysis chatbots →Productivity
AI tools for task management, scheduling, summarization, and workflow optimization.
Browse Productivity chatbots →Troubleshooting
- Responses seem generic or unhelpful
- Add more context to your prompt. Specify the audience, tone, length, and format you need. Try starting over with a clearer description of your goal.
- The tool isn't responding or is slow
- AI chatbots can experience high traffic. Refresh the page and try again. Check the service's status page if issues persist.
- Output is too long or too short
- Explicitly specify the length: "in 100 words," "as a brief summary," or "in detail with examples."
Get Weekly Chatbot Tips
Not sure which AI tool is right for you? Our newsletter covers reviews, tutorials, and comparisons weekly.
Frequently Asked Questions
- Is SentinelOne Purple AI free to use?
- SentinelOne Purple AI requires a paid subscription, starting from Contact for pricing.
- Do I need an account to use SentinelOne Purple AI?
- Yes, you need to create an account to use SentinelOne Purple AI.
- What can I use SentinelOne Purple AI for?
- SentinelOne Purple AI is an AI-powered security analyst that automates threat hunting, alert investigation, and incident response in natural language. Built into the Singularity platform, it runs autonomous investigations and generates remediation scripts.
Related Guides
Know a tool we're missing? Submit it free →