purple_ai
Investigate cybersecurity threats, generate PowerQueries, and get answers about SentinelOne by asking questions in plain language.
Instructions
Interact with SentinelOne's Purple AI, a cybersecurity assistant that helps you investigate threats, generate PowerQueries, and answer questions about SentinelOne. Purple AI understands natural language and converts your questions into structured security queries, or answers in plain language.
What Purple AI can do:
Generate and explain PowerQueries for threat hunting and detection
Help answer questions using threat intelligence and behavioral signals
Explore user, process, network, and file-based activities
Investigate MITRE TTPs, ransomware behavior, lateral movement, and more
Answer questions about SentinelOne capabilities
What Purple AI can't do:
Access active alerts (use the Alerts tool for that)
Modify configurations or directly interact with your endpoints
Run the PowerQueries itself (use the PowerQuery tool to run the PQ returned by Purple AI)
How to ask good questions
Purple AI works best when your questions are:
Descriptive: Include process names, file paths, domains, ports, or usernames
Focused: Describe what you're trying to understand or find
Scoped: If helpful, include filters like time ranges, endpoint type, or OS
Example questions:
Show me PowerShell processes that connected to external IPs
Find unsigned processes that accessed lsass.exe
List endpoints where the user “jsmith” logged in more than 5 times
Are there any reverse SSH tunnels from public IPs?
Find living-off-the-land binaries spawned from Microsoft Word
DO NOT instruct Purple AI to "Generate a Powerquery to ...". Instead, just say what you are looking for. Example: - GOOD: "Is APT-1337 in my environment?" - BAD: "Generate a PowerQuery to determine if APT-1337 is in my environment, including their typical tools, processes, and TTPs."
Tips for writing questions
Start with verbs like: show, find, list, search
Add specific entities like: powershell, svchost, lolbins, ssh, .tmp files
Use filters like: external IPs, non-Windows folders, file size over 1GB
Ask about behaviors: ransomware, persistence, privilege escalation, data staging, beaconing, phishing
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| query | Yes |
Output Schema
| Name | Required | Description | Default |
|---|---|---|---|
| result | Yes |