SentinelOne Purple AI Investigation

The SentinelOne Purple AI skill empowers security analysts and MSPs to conduct deep-dive threat investigations using natural language within the Claude Code environment. By leveraging the purple_ai MCP tool, users can describe suspicious behaviors in plain English to receive detailed threat analysis, generate complex PowerQuery strings for the Singularity Data Lake, and map findings directly to the MITRE ATT&CK framework. It excels at identifying attack chains across endpoints, cloud workloads, and identities, providing a streamlined, read-only workflow for rapid forensic analysis and behavioral anomaly detection.

Key Features

Use Cases