Purple AI.
The Agentic Security Analyst.

Unlike chat-based assistants that only answer questions, Purple AI reasons across normalized security data. It advances investigations, documents decisions, and keeps work moving inside detection and response workflows.

Purple AI is built for SOC analysts, incident responders, and security leaders who need faster, more confident decisions during triage, investigation, and response without increasing operational complexity.

Purple AI reasons over OCSF-normalized data from native SentinelOne telemetry and integrated third-party sources, giving it consistent context across alerts, endpoints, cloud, and identity data.

Purple AI helps junior analysts ramp faster through guided investigations. It also frees senior analysts from repetitive triage and documentation so they can focus on higher-value proactive work.

Purple AI is built with privacy-first safeguards, human-in-the-loop authority, and secure-by-design controls. Your data is yours and yours alone, and is never used to train shared models.

Teams get started by deploying Purple AI within the Singularity Platform. They can evaluate it against real alerts and investigations, with guided onboarding, training, and ongoing customer success support.

An AI SOC analyst is an AI-powered system that operates alongside human security analysts to accelerate triage, investigation, and response. Purple AI is SentinelOne's AI SOC analyst, reasoning across OCSF-normalized data at machine speed to guide decisions, document findings, and recommend actions within existing SecOps workflows.