cyber threats become increasingly advanced, security teams require cutting-edge tools driven by generative AI to identify and respond to threats with the speed and precision of machines. At SentinelOne, this vision is already taking shape through Purple AI, an innovative solution designed to empower security teams and maintain a proactive stance against evolving attacks. Purple AI stands as the industry’s most sophisticated AI security analyst.

It simplifies critical tasks such as threat hunting, drafting complex queries, conducting investigations, and navigating intricate data structures within SentinelOne’s platform and integrated partner log sources. By streamlining these workflows, Purple enables your team to focus their efforts on addressing challenges rather than getting bogged down by time-consuming processes.

Today, we’re excited to announce two important new features in Purple AI that deliver the next step in AI security innovation to accelerate efficiencies for security teams:

• Expanded Third-Party Log Source Support – Enabling SOC teams to detect threats earlier with expanded data visibility and a unified data stream across the enterprise.
• Early Access to Multilingual Question Support – Equipping global security teams and organizations to hunt, investigate, and respond faster in their preferred language.

Partner Log Sources | Unlock Deeper Data Visibility for Faster, Smarter Responses

Organizations utilize a variety of data sources to establish robust defenses. Yet, the influx of data often brings the challenge of understanding unfamiliar data schemas and navigating intricate query languages.

Purple AI addresses this issue for security teams by streamlining data management. As the industry's only GenAI security analyst built with normalized data ingestion through the Open Cybersecurity Schema Framework (OCSF), it enables instant querying across both native and third-party data sources. This approach ensures scalability for growing datasets and provides unified data views, accelerating the investigation process.

We’re helping security teams further harness the power of data and AI by expanding Purple’s supported third-party log sources to include:

• Palo Alto Networks Firewall
• ZScaler Internet Access
• Proofpoint TAP
• Microsoft Office 365
• Fortinet FortiGate
• Okta

With Purple AI, your SOC can leverage this expanded data to uncover threats faster, gain broader visibility, and focus on making critical decisions. Purple AI takes the complexity out of querying, ensuring that more data doesn’t slow you down but, instead, empowers faster and more efficient security processes.

Broaden Your Visibility

Starting today, security teams can leverage the full breadth of Purple AI’s threat hunting and investigation capabilities to query across an expansive list of native and third party sources. Security analysts can ask questions like:

“Show how many users accessed cloud applications from Zscaler Internet Access logs from Dec 21-23 2024,” or “Show user accounts in Okta with the highest number of failed login attempts today.”

Alternatively, use a Quickstart question to begin a conversation with Purple AI. Receive a precise events table tailored to the new data sources along with relevant PowerQuery syntax. Users can also leverage contextual follow-ups to uncover deeper insights across expanded datasets without missing a beat.