SentinelOne Purple AI
Agentic AI investigator built into SentinelOne's Singularity XDR
Overview
SentinelOne's generative-AI security analyst, now agentic: it can autonomously investigate and verdict alerts across endpoint, identity and cloud telemetry using a mix of Claude, GPT and SentinelOne's own Ultraviolet models, sold as an add-on to the Singularity XDR platform.
Use cases
What you can produce with SentinelOne Purple AI
- Natural-language threat hunting across endpoint/identity/cloud telemetry
- Agentic, zero-click alert investigation with verdicts
- Auditable evidence chain for every AI-driven action
- Multi-model reasoning (Claude, GPT, SentinelOne Ultraviolet)
- Adjustable human-in-the-loop autonomy controls
- Auto-summarized incident and investigation reports
- Metered via Singularity Credits across the platform
ASEAN Perspective
SentinelOne Purple AI in Southeast Asia
ASEAN-region availability and pricing notes coming soon. Drop the editorial team a note via /contact/ if you can supply local context (Singapore/Malaysia/Indonesia/Thailand/Vietnam).
Purple AI moved from chat-style threat hunting to autonomous investigation in June 2026: when an alert crosses a set threshold, it can investigate, render a verdict and act without an analyst driving each step, then hand over a full evidence trail for review. SentinelOne routes the reasoning through a mix of Claude, GPT and its own Ultraviolet models rather than a single vendor's LLM, which is unusual for this category. Reviewers on G2 like the natural-language query interface for cutting through raw telemetry, though the honest caveat is that "agentic" tools still need a human checking the verdict chain, especially early on.
It only makes sense bolted onto Singularity XDR — this isn't a bring-your-own-SIEM product. Pricing runs through SentinelOne's new Singularity Credits currency rather than a clean line-item price, and the current free trial allotment will eventually convert to metered spend. Fine for shops already on SentinelOne; irrelevant otherwise.
What people say
SentinelOne rolled Purple AI out in stages: unveiled at RSA 2023, generally available as a chat-based hunting assistant in April 2024, and reworked into an "agentic investigation" mode in June 2026 that runs autonomously on flagged alerts rather than waiting for an analyst to type a query. The pitch now is zero-click triage — Purple AI investigates, assigns a verdict, and (depending on the autonomy level a customer sets) can act on it, with every step logged for audit.
On G2, SentinelOne's broader Singularity portfolio carries strong marks (SentinelOne overall sits around 4.7 stars across 361+ reviews), and reviewers specifically credit Purple AI's natural-language search for letting less experienced analysts dig into telemetry that would otherwise require raw query syntax. The most consistent complaint across SentinelOne review pages generally, echoed in buyer commentary about Purple AI licensing, is that pricing isn't published anywhere — SentinelOne routes everyone through direct sales, and trade-press writeups note list figures in the $35–75+ per endpoint range with heavy negotiated discounts at volume.
The technical detail worth knowing: Purple AI's reasoning isn't one model. SentinelOne blends Anthropic's Claude, OpenAI's GPT and its own security-tuned "Ultraviolet" models depending on the task, a different bet than competitors standardizing on a single foundation model. For the June 2026 agentic release, SentinelOne introduced "Singularity Credits" as a unified currency for AI-driven work platform-wide, and is giving existing customers a complimentary allotment to test agentic investigation before it becomes a metered cost.
There's no independent standalone review corpus for Purple AI as distinct from the Singularity platform it rides on — G2, Gartner Peer Insights and TrustRadius all fold it into SentinelOne's broader endpoint/XDR review pages rather than treating it as its own line item, and TrustRadius doesn't list any Purple AI pricing plans at all. That's consistent with how SentinelOne sells it: not a separate purchase decision, but a capability turned on inside an existing SentinelOne contract.
Summary of public user & expert reviews, compiled by RECATOOLS.
About this listing
This entry was compiled from publicly available data including SentinelOne Purple AI's official website, press releases, documentation, and reputable third-party publications. RECATOOLS is not affiliated with SentinelOne Purple AI unless explicitly stated.
Third-party AI tools update their pricing, features, availability, and policies frequently. Information here may be outdated by the time you read this — we make reasonable efforts to keep listings current, but cannot guarantee absolute accuracy.
For the latest details, please refer to SentinelOne Purple AI directly →
Spotted something out of date? Suggest an update →
More in Security & Safety
