SentinelOne Purple AI
Overview
Purple AI is SentinelOne's natural language cybersecurity assistant built into the Singularity platform. Through the purple_ai MCP tool, you can ask investigative questions in plain English and receive threat analysis, PowerQuery strings for hunting, MITRE ATT&CK TTP mappings, and contextual security intelligence. Purple AI understands the full SentinelOne telemetry model and can reason across endpoints, cloud workloads, identities, and network data.
Purple AI is the primary starting point for any investigation -- describe what you want to find and it will generate the appropriate PowerQuery or provide analysis. It is read-only and cannot take any remediation actions.
Anti-triggers
- Executing a query you already have.
purple_ai writes PowerQuery;
it does not run it. Hand the generated string to
sentinelone-threat-hunting.
- Working the existing alert queue. Purple AI answers open-ended
questions against telemetry — listing, filtering, or reading notes on
alerts that already exist is
sentinelone-alerts.
- Hunting on non-SentinelOne telemetry. Purple AI reasons only over
the Singularity Data Lake. Huntress detections are
huntress-signals;
ThreatLocker execution history is threatlocker-audit-log.
MCP Tools
Available Tools
| Tool |
Description |
Key Parameters |
purple_ai |
Natural language cybersecurity assistant |
query (required) - natural language investigation prompt |
Using purple_ai
Call purple_ai with a natural language query describing what you want to investigate:
Example: Investigate suspicious PowerShell activity:
purple_ai with query="Find PowerShell processes that have established network connections to external IP addresses in the last 24 hours"
Example: Generate a threat hunting query:
purple_ai with query="I need to find evidence of lateral movement using PsExec or WMI across managed endpoints"
Example: MITRE ATT&CK analysis:
purple_ai with query="What MITRE ATT&CK techniques are associated with recent alert activity?"
Key Concepts
Natural Language Investigation
Purple AI interprets natural language descriptions of threats, behaviors, and investigation goals. The key to effective use is describing what you want to find, not how to query for it.
Good prompts:
- "Find processes that are connecting to known C2 infrastructure"
- "Show me evidence of credential dumping on Windows endpoints"
- "Are there any endpoints where LSASS memory was accessed by unusual processes?"
- "Find PowerShell scripts that download and execute content from the internet"
Avoid:
- "Generate a PowerQuery for..." (Purple AI works better when you describe the threat, not the output format)
- "SELECT * FROM..." (Purple AI does not use SQL)
- Overly generic requests like "Show me everything suspicious"
PowerQuery Generation
Purple AI frequently returns PowerQuery strings as part of its response. These queries can then be executed against the Singularity Data Lake using the powerquery tool. The typical workflow is:
- Ask Purple AI a natural language question
- Purple AI returns analysis and one or more PowerQuery strings
- Execute the PowerQuery with the
powerquery tool
- Analyze the results
MITRE ATT&CK Integration
Purple AI maps threats and behaviors to the MITRE ATT&CK framework:
| Category |
Examples |
| Initial Access |
Phishing, drive-by compromise, supply chain |
| Execution |
PowerShell, command-line, scripting engines |
| Persistence |
Registry run keys, scheduled tasks, services |
| Privilege Escalation |
Token manipulation, UAC bypass |
| Defense Evasion |
Process injection, timestomping, obfuscation |
| Credential Access |
LSASS dump, Kerberoasting, brute force |
| Discovery |
Network scanning, account enumeration |
| Lateral Movement |
PsExec, WMI, RDP, SMB |
| Collection |
Data staging, clipboard capture |
| Command & Control |
Beaconing, DNS tunneling, encrypted channels |
| Exfiltration |
Data compression, exfil over C2 |
| Impact |
Encryption (ransomware), data destruction |
What Purple AI Is NOT For
Purple AI is an investigative assistant. It does not:
- Modify alert status or assignments
- Quarantine or isolate endpoints
- Block threats or take response actions
- Replace the
list_alerts, get_alert, or other specific tools for structured data retrieval
- Execute PowerQuery -- use the
powerquery tool for execution
For active alert management, use the alert tools (list_alerts, get_alert, etc.). For running queries against the Data Lake, use the powerquery tool.
Common Investigation Queries
Endpoint Threats
| Investigation |
Purple AI Query |
| Suspicious PowerShell |
"Find PowerShell processes connecting to external IP addresses on non-standard ports" |
| LOLBIN Activity |
"Show me Living-off-the-Land Binary activity like certutil, mshta, or regsvr32 downloading files" |
| Process Lineage |
"Trace the parent process chain for any suspicious child processes of explorer.exe" |
| Ransomware Indicators |
"Find evidence of mass file encryption or modification of shadow copies" |
| Fileless Malware |
"Detect processes running entirely from memory without a backing file on disk" |
Lateral Movement
| Investigation |
Purple AI Query |
| PsExec Usage |
"Detect PsExec or similar remote execution tools being used across the network" |
| WMI Remote Exec |
"Find WMI-based remote process creation events" |
| RDP Anomalies |
"Show unusual RDP connections, especially from endpoints that don't normally use RDP" |
| SMB Lateral |
"Find SMB connections followed by service creation on remote hosts" |
| Pass-the-Hash |
"Detect NTLM authentication attempts that may indicate pass-the-hash attacks" |
Credential Access
| Investigation |
Purple AI Query |
| LSASS Access |
"Find processes accessing LSASS memory, excluding known legitimate tools" |
| Kerberoasting |
"Detect Kerberos TGS requests for service accounts that may indicate Kerberoasting" |
| Credential Files |
"Find access to files commonly containing credentials like SAM, NTDS.dit, or browser credential stores" |
| Brute Force |
"Show accounts with failed login attempts exceeding 10 in the last hour" |
Command & Control
| Investigation |
Purple AI Query |
| Beaconing |
"Detect periodic outbound connections that may indicate C2 beaconing behavior" |
| DNS Tunneling |
"Find DNS queries with unusually long subdomain names or high query volumes to a single domain" |
| Encoded Traffic |
"Show processes making HTTPS connections to recently registered domains" |
| Non-Standard Ports |
"Find outbound connections on unusual ports from common applications" |
Data Exfiltration
| Investigation |
Purple AI Query |
| Large Transfers |
"Detect large outbound data transfers exceeding 100MB to external destinations" |
| Archive Creation |
"Find creation of compressed archives (zip, rar, 7z) followed by network activity" |
| Cloud Upload |
"Show uploads to cloud storage services like Dropbox, Google Drive, or OneDrive from unauthorized endpoints" |
| Staging |
"Detect files being copied to a common staging directory before exfiltration" |
Phishing
| Investigation |
Purple AI Query |
| Phishing Artifacts |
"Find Outlook or browser processes spawning PowerShell, cmd, or script interpreters" |
| Macro Execution |
"Detect Office applications launching child processes that indicate macro execution" |
| Link Clicks |
"Show browser navigations to newly registered or low-reputation domains from email link clicks" |
Response Examples
Purple AI Response (PowerQuery Generated):
Based on your investigation, I've generated a PowerQuery to find PowerShell
processes with external network connections:
EventType = "IP Connect" AND SrcProcName = "powershell.exe" AND
NetConnStatus = "SUCCESS" AND NOT DstIP In ("10.0.0.0/8", "172.16.0.0/12", "192.168.0.0/16")
| columns EndpointName, SrcProcName, SrcProcCmdLine, DstIP, DstPort, EventTime
| sort -EventTime
| limit 100
This query looks for:
- Process: powershell.exe
- Event: Successful IP connections
- Destination: External IPs (excluding RFC 1918 private ranges)
MITRE ATT&CK Mapping:
- T1059.001 - Command and Scripting Interpreter: PowerShell
- T1071 - Application Layer Protocol
Purple AI Response (Analysis):
Based on the alert data, this activity is consistent with a multi-stage
attack chain:
1. Initial Access: Phishing email with malicious attachment (T1566.001)
2. Execution: Word document macro launching PowerShell (T1059.001)
3. Defense Evasion: Base64-encoded commands (T1027)
4. C2: Beaconing to external IP 203.0.113.42 every 60 seconds (T1071.001)
Recommended next steps:
- Investigate the source email and other recipients
- Check for lateral movement from the affected endpoint
- Review the PowerShell command line for IOCs
- Check if the C2 IP appears on other endpoints
Error Handling
Common Errors
| Error |
Cause |
Resolution |
| Empty response |
Query too vague |
Be more specific about the threat or behavior you're investigating |
| Authentication error |
Invalid token |
Verify Service User token is Account or Site level |
| Timeout |
Complex query or overloaded system |
Simplify the query or try again later |
| No matching data |
No telemetry matching the criteria |
Widen the time range or adjust the investigation scope |
Best Practices
- Describe the threat, not the query format - Say "Find PowerShell connecting to external IPs" not "Generate a PowerQuery for PowerShell"
- Be specific about behaviors - Include details like process names, network indicators, or file paths
- Include context - Mention the client, time frame, or related alerts when relevant
- Follow up on results - Use Purple AI iteratively to dig deeper into findings
- Execute generated queries - Always run Purple AI's PowerQuery output through the
powerquery tool for actual results
- Combine with alert tools - Use Purple AI for investigation, then cross-reference with
list_alerts or get_alert for specific alert context
- Map to MITRE - Ask Purple AI to map findings to MITRE ATT&CK for consistent reporting
- Use for QBR preparation - Generate threat summaries for quarterly business reviews with clients
- Think in attack chains - Investigate related TTPs, not just isolated events
- Document investigation steps - Keep notes on Purple AI queries and findings for incident reports
Related Skills
1---2name: sentinelone-purple-ai3description: The `purple_ai` tool — SentinelOne's natural language investigation assistant over the full Singularity telemetry model. Covers how to phrase investigative prompts, behavioral anomaly and MITRE ATT&CK TTP analysis, PowerQuery generation, and handing generated queries to the `powerquery` tool for execution.4---56# SentinelOne Purple AI78## Overview910Purple AI is SentinelOne's natural language cybersecurity assistant built into the Singularity platform. Through the `purple_ai` MCP tool, you can ask investigative questions in plain English and receive threat analysis, PowerQuery strings for hunting, MITRE ATT&CK TTP mappings, and contextual security intelligence. Purple AI understands the full SentinelOne telemetry model and can reason across endpoints, cloud workloads, identities, and network data.1112Purple AI is the primary starting point for any investigation -- describe what you want to find and it will generate the appropriate PowerQuery or provide analysis. It is **read-only** and cannot take any remediation actions.1314## Anti-triggers1516- **Executing a query you already have.** `purple_ai` writes PowerQuery;17 it does not run it. Hand the generated string to18 `sentinelone-threat-hunting`.19- **Working the existing alert queue.** Purple AI answers open-ended20 questions against telemetry — listing, filtering, or reading notes on21 alerts that already exist is `sentinelone-alerts`.22- **Hunting on non-SentinelOne telemetry.** Purple AI reasons only over23 the Singularity Data Lake. Huntress detections are `huntress-signals`;24 ThreatLocker execution history is `threatlocker-audit-log`.2526## MCP Tools2728### Available Tools2930| Tool | Description | Key Parameters |31|------|-------------|----------------|32| `purple_ai` | Natural language cybersecurity assistant | `query` (required) - natural language investigation prompt |3334### Using purple_ai3536Call `purple_ai` with a natural language `query` describing what you want to investigate:3738**Example: Investigate suspicious PowerShell activity:**39- `purple_ai` with `query="Find PowerShell processes that have established network connections to external IP addresses in the last 24 hours"`4041**Example: Generate a threat hunting query:**42- `purple_ai` with `query="I need to find evidence of lateral movement using PsExec or WMI across managed endpoints"`4344**Example: MITRE ATT&CK analysis:**45- `purple_ai` with `query="What MITRE ATT&CK techniques are associated with recent alert activity?"`4647## Key Concepts4849### Natural Language Investigation5051Purple AI interprets natural language descriptions of threats, behaviors, and investigation goals. The key to effective use is describing **what you want to find**, not how to query for it.5253**Good prompts:**54- "Find processes that are connecting to known C2 infrastructure"55- "Show me evidence of credential dumping on Windows endpoints"56- "Are there any endpoints where LSASS memory was accessed by unusual processes?"57- "Find PowerShell scripts that download and execute content from the internet"5859**Avoid:**60- "Generate a PowerQuery for..." (Purple AI works better when you describe the threat, not the output format)61- "SELECT * FROM..." (Purple AI does not use SQL)62- Overly generic requests like "Show me everything suspicious"6364### PowerQuery Generation6566Purple AI frequently returns PowerQuery strings as part of its response. These queries can then be executed against the Singularity Data Lake using the `powerquery` tool. The typical workflow is:67681. Ask Purple AI a natural language question692. Purple AI returns analysis and one or more PowerQuery strings703. Execute the PowerQuery with the `powerquery` tool714. Analyze the results7273### MITRE ATT&CK Integration7475Purple AI maps threats and behaviors to the MITRE ATT&CK framework:7677| Category | Examples |78|----------|---------|79| **Initial Access** | Phishing, drive-by compromise, supply chain |80| **Execution** | PowerShell, command-line, scripting engines |81| **Persistence** | Registry run keys, scheduled tasks, services |82| **Privilege Escalation** | Token manipulation, UAC bypass |83| **Defense Evasion** | Process injection, timestomping, obfuscation |84| **Credential Access** | LSASS dump, Kerberoasting, brute force |85| **Discovery** | Network scanning, account enumeration |86| **Lateral Movement** | PsExec, WMI, RDP, SMB |87| **Collection** | Data staging, clipboard capture |88| **Command & Control** | Beaconing, DNS tunneling, encrypted channels |89| **Exfiltration** | Data compression, exfil over C2 |90| **Impact** | Encryption (ransomware), data destruction |9192### What Purple AI Is NOT For9394Purple AI is an investigative assistant. It does **not**:95- Modify alert status or assignments96- Quarantine or isolate endpoints97- Block threats or take response actions98- Replace the `list_alerts`, `get_alert`, or other specific tools for structured data retrieval99- Execute PowerQuery -- use the `powerquery` tool for execution100101For active alert management, use the alert tools (`list_alerts`, `get_alert`, etc.). For running queries against the Data Lake, use the `powerquery` tool.102103## Common Investigation Queries104105### Endpoint Threats106107| Investigation | Purple AI Query |108|--------------|----------------|109| Suspicious PowerShell | "Find PowerShell processes connecting to external IP addresses on non-standard ports" |110| LOLBIN Activity | "Show me Living-off-the-Land Binary activity like certutil, mshta, or regsvr32 downloading files" |111| Process Lineage | "Trace the parent process chain for any suspicious child processes of explorer.exe" |112| Ransomware Indicators | "Find evidence of mass file encryption or modification of shadow copies" |113| Fileless Malware | "Detect processes running entirely from memory without a backing file on disk" |114115### Lateral Movement116117| Investigation | Purple AI Query |118|--------------|----------------|119| PsExec Usage | "Detect PsExec or similar remote execution tools being used across the network" |120| WMI Remote Exec | "Find WMI-based remote process creation events" |121| RDP Anomalies | "Show unusual RDP connections, especially from endpoints that don't normally use RDP" |122| SMB Lateral | "Find SMB connections followed by service creation on remote hosts" |123| Pass-the-Hash | "Detect NTLM authentication attempts that may indicate pass-the-hash attacks" |124125### Credential Access126127| Investigation | Purple AI Query |128|--------------|----------------|129| LSASS Access | "Find processes accessing LSASS memory, excluding known legitimate tools" |130| Kerberoasting | "Detect Kerberos TGS requests for service accounts that may indicate Kerberoasting" |131| Credential Files | "Find access to files commonly containing credentials like SAM, NTDS.dit, or browser credential stores" |132| Brute Force | "Show accounts with failed login attempts exceeding 10 in the last hour" |133134### Command & Control135136| Investigation | Purple AI Query |137|--------------|----------------|138| Beaconing | "Detect periodic outbound connections that may indicate C2 beaconing behavior" |139| DNS Tunneling | "Find DNS queries with unusually long subdomain names or high query volumes to a single domain" |140| Encoded Traffic | "Show processes making HTTPS connections to recently registered domains" |141| Non-Standard Ports | "Find outbound connections on unusual ports from common applications" |142143### Data Exfiltration144145| Investigation | Purple AI Query |146|--------------|----------------|147| Large Transfers | "Detect large outbound data transfers exceeding 100MB to external destinations" |148| Archive Creation | "Find creation of compressed archives (zip, rar, 7z) followed by network activity" |149| Cloud Upload | "Show uploads to cloud storage services like Dropbox, Google Drive, or OneDrive from unauthorized endpoints" |150| Staging | "Detect files being copied to a common staging directory before exfiltration" |151152### Phishing153154| Investigation | Purple AI Query |155|--------------|----------------|156| Phishing Artifacts | "Find Outlook or browser processes spawning PowerShell, cmd, or script interpreters" |157| Macro Execution | "Detect Office applications launching child processes that indicate macro execution" |158| Link Clicks | "Show browser navigations to newly registered or low-reputation domains from email link clicks" |159160## Response Examples161162**Purple AI Response (PowerQuery Generated):**163164```165Based on your investigation, I've generated a PowerQuery to find PowerShell166processes with external network connections:167168EventType = "IP Connect" AND SrcProcName = "powershell.exe" AND169NetConnStatus = "SUCCESS" AND NOT DstIP In ("10.0.0.0/8", "172.16.0.0/12", "192.168.0.0/16")170| columns EndpointName, SrcProcName, SrcProcCmdLine, DstIP, DstPort, EventTime171| sort -EventTime172| limit 100173174This query looks for:175- Process: powershell.exe176- Event: Successful IP connections177- Destination: External IPs (excluding RFC 1918 private ranges)178179MITRE ATT&CK Mapping:180- T1059.001 - Command and Scripting Interpreter: PowerShell181- T1071 - Application Layer Protocol182```183184**Purple AI Response (Analysis):**185186```187Based on the alert data, this activity is consistent with a multi-stage188attack chain:1891901. Initial Access: Phishing email with malicious attachment (T1566.001)1912. Execution: Word document macro launching PowerShell (T1059.001)1923. Defense Evasion: Base64-encoded commands (T1027)1934. C2: Beaconing to external IP 203.0.113.42 every 60 seconds (T1071.001)194195Recommended next steps:196- Investigate the source email and other recipients197- Check for lateral movement from the affected endpoint198- Review the PowerShell command line for IOCs199- Check if the C2 IP appears on other endpoints200```201202## Error Handling203204### Common Errors205206| Error | Cause | Resolution |207|-------|-------|------------|208| Empty response | Query too vague | Be more specific about the threat or behavior you're investigating |209| Authentication error | Invalid token | Verify Service User token is Account or Site level |210| Timeout | Complex query or overloaded system | Simplify the query or try again later |211| No matching data | No telemetry matching the criteria | Widen the time range or adjust the investigation scope |212213## Best Practices2142151. **Describe the threat, not the query format** - Say "Find PowerShell connecting to external IPs" not "Generate a PowerQuery for PowerShell"2162. **Be specific about behaviors** - Include details like process names, network indicators, or file paths2173. **Include context** - Mention the client, time frame, or related alerts when relevant2184. **Follow up on results** - Use Purple AI iteratively to dig deeper into findings2195. **Execute generated queries** - Always run Purple AI's PowerQuery output through the `powerquery` tool for actual results2206. **Combine with alert tools** - Use Purple AI for investigation, then cross-reference with `list_alerts` or `get_alert` for specific alert context2217. **Map to MITRE** - Ask Purple AI to map findings to MITRE ATT&CK for consistent reporting2228. **Use for QBR preparation** - Generate threat summaries for quarterly business reviews with clients2239. **Think in attack chains** - Investigate related TTPs, not just isolated events22410. **Document investigation steps** - Keep notes on Purple AI queries and findings for incident reports225226## Related Skills227228- [Threat Hunting](../threat-hunting/SKILL.md) - PowerQuery execution against the Data Lake229- [Alerts](../alerts/SKILL.md) - Structured alert retrieval and triage230- [API Patterns](../api-patterns/SKILL.md) - MCP tools reference and connection info231- [Vulnerabilities](../vulnerabilities/SKILL.md) - Vulnerability context for investigations232- [Inventory](../inventory/SKILL.md) - Asset context for investigations
WYRE-AI