purple-ai

What problem does it solve?

This Skill empowers cybersecurity analysts to rapidly investigate threats, hunt for malicious activity, and understand security incidents using natural language queries within the SentinelOne platform.

Core Features & Use Cases

• Natural Language Investigation: Ask questions about threats, behaviors, and anomalies in plain English.
• PowerQuery Generation: Automatically generates PowerQuery strings for in-depth data analysis.
• MITRE ATT&CK Mapping: Provides context by mapping findings to MITRE ATT&CK techniques.
• Use Case: An analyst can ask "Find PowerShell processes connecting to external IPs in the last 24 hours" and receive both an analysis and a ready-to-execute PowerQuery.

Quick Start

Use the purple_ai tool to investigate suspicious PowerShell activity by asking it to find PowerShell processes that have established network connections to external IP addresses in the last 24 hours.