/purple-ai

name: "SentinelOne Purple AI"
description: >
  The `purple_ai` tool — SentinelOne's natural language investigation assistant over
  the full Singularity telemetry model. Covers how to phrase investigative prompts,
  behavioral anomaly and MITRE ATT&CK TTP analysis, PowerQuery generation, and
  handing generated queries to the `powerquery` tool for execution.
when_to_use: >-
  When starting a SentinelOne investigation from a natural-language question, or generating
  PowerQuery rather than writing it by hand. Use when: sentinelone purple ai, purple ai, threat
  investigation, threat hunting sentinelone, sentinelone investigate, sentinelone natural
  language, sentinelone mitre, sentinelone ttp, powerquery generation, sentinelone behavioral,
  sentinelone anomaly, or purple ai query.

SentinelOne Purple AI

Overview

Purple AI is SentinelOne's natural language cybersecurity assistant built into the Singularity platform. Through the `purple_ai` MCP tool, you can ask investigative questions in plain English and receive threat analysis, PowerQuery strings for hunting, MITRE ATT&CK TTP mappings, and contextual security intelligence. Purple AI understands the full SentinelOne telemetry model and can reason across endpoints, cloud workloads, identities, and network data.

Purple AI is the primary starting point for any investigation -- describe what you want to find and it will generate the appropriate PowerQuery or provide analysis. It is **read-only** and cannot take any remediation actions.

Anti-triggers

• **Executing a query you already have.** `purple_ai` writes PowerQuery;

it does not run it. Hand the generated string to `sentinelone-threat-hunting`.

• **Working the existing alert queue.** Purple AI answers open-ended

questions against telemetry — listing, filtering, or reading notes on alerts that already exist is `sentinelone-alerts`.

• **Hunting on non-SentinelOne telemetry.** Purple AI reasons only over

the Singularity Data Lake. Huntress detections are `huntress-signals`; ThreatLocker execution history is `threatlocker-audit-log`.

MCP Tools

Available Tools

| Tool | Description | Key Parameters | |------|-------------|----------------| | `purple_ai` | Natural language cybersecurity assistant | `query` (required) - natural language investigation prompt |

Using purple_ai

Call `purple_ai` with a natural language `query` describing what you want to investigate:

**Example: Investigate suspicious PowerShell activity:**

• `purple_ai` with `query="Find PowerShell processes that have established network connections to external IP addresses in the last 24 hours"`

**Example: Generate a threat hunting query:**

• `purple_ai` with `query="I need to find evidence of lateral movement using PsExec or WMI across managed endpoints"`

**Example: MITRE ATT&CK analysis:**

• `purple_ai` with `query="What MITRE ATT&CK techniques are associated with recent alert activity?"`

Key Concepts

Natural Language Investigation

Purple AI interprets natural language descriptions of threats, behaviors, and investigation goals. The key to effective use is describing **what you want to find**, not how to query for it.

**Good prompts:**

• "Find processes that are connecting to known C2 infrastructure"
• "Show me evidence of credential dumping on Windows endpoints"
• "Are there any endpoints where LSASS memory was accessed by unusual processes?"
• "Find PowerShell scripts that download and execute content from the internet"

**Avoid:**

• "Generate a PowerQuery for..." (Purple AI works better when you describe the threat, not the output format)
• "SELECT * FROM..." (Purple AI does not use SQL)
• Overly generic requests like "Show me everything suspicious"

PowerQuery Generation

Purple AI frequently returns PowerQuery strings as part of its response. These queries can then be executed against the Singularity Data Lake using the `powerquery` tool. The typical workflow is:

1. Ask Purple AI a natural language question 2. Purple AI returns analysis and one or more PowerQuery strings 3. Execute the PowerQuery with the `powerquery` tool 4. Analyze the results

MITRE ATT&CK Integration

Purple AI maps threats and behaviors to the MITRE ATT&CK framework:

| Category | Examples | |----------|---------| | **Initial Access** | Phishing, drive-by compromise, supply chain | | **Execution** | PowerShell, command-line, scripting engines | | **Persistence** | Registry run keys, scheduled tasks, services | | **Privilege Escalation** | Token manipulation, UAC bypass | | **Defense Evasion** | Process injection, timestomping, obfuscation | | **Credential Access** | LSASS dump, Kerberoasting, brute force | | **Discovery** | Network scanning, account enumeration | | **Lateral Movement** | PsExec, WMI, RDP, SMB | | **Collection** | Data staging, clipboard capture | | **Command & Control** | Beaconing, DNS tunneling, encrypted channels | | **Exfiltration** | Data compression, exfil over C2 | | **Impact** | Encryption (ransomware), data destruction |

What Purple AI Is NOT For

Purple AI is an investigative assistant. It does **not**:

• Modify alert status or assignments
• Quarantine or isolate endpoints
• Block threats or take response actions
• Replace the `list_alerts`, `get_alert`, or other specific tools for structured data retrieval
• Execute PowerQuery -- use the `powerquery` tool for execution

For active alert management, use the alert tools (`list_alerts`, `get_alert`, etc.). For running queries against the Data Lake, use the `powerquery` tool.

Common Investigation Queries

Endpoint Threats

| Investigation | Purple AI Query | |--------------|----------------| | Suspicious PowerShell | "Find PowerShell processes connecting to external IP addresses on non-standard ports" | | LOLBIN Activity | "Show me Living-off-the-Land Binary activity like certutil, mshta, or regsvr32 downloading files" | | Process Lineage | "Trace the parent process chain for any suspicious chil