SentinelOne Singularity Explained: The Autonomous Agent, Storylines, Purple AI and Rollback

SentinelOne is CrowdStrike's most frequent comparison in endpoint security interviews. Its design emphasis is different: the agent is built to make detection and response decisions on the device itself, and the console groups activity into Storylines so analysts work with whole attack chains rather than single events.

What it is

The Singularity Platform covers endpoints, cloud workloads, identity and, since 2025, AI usage. Its main parts are:

• The agent, with static and behavioural AI engines that decide locally whether something is malicious, so protection does not depend on reaching the cloud.
• Singularity Data Lake and Singularity AI SIEM, where telemetry is stored and searched with PowerQuery.
• Purple AI, an assistant that turns natural-language questions into queries. Its "Auto Investigation" became generally available in March 2026, and it gathers evidence, builds a timeline and proposes a verdict.
• Singularity Cloud, cloud posture and workload protection, extended by the 2024 acquisition of PingSafe.
• Prompt AI, from the Prompt Security acquisition completed in September 2025, for controlling and securing employees' and agents' use of generative AI.

How it works

Because the agent links related events into a Storyline as they happen, one response action can apply to the whole chain: kill the processes, quarantine the files they dropped, and, on Windows, roll back changes using Volume Shadow Copy snapshots. Custom detection rules can be built from hunting queries so that a query you wrote during one investigation alerts the next time the pattern appears.

How to use it

Day one: deploy and set policy

Deploy the agent through your device management tooling and organise endpoints into sites and groups so policies match ownership. Start in a detect-only or alert mode on a pilot group if you need to measure false positives, then move to protect mode. Make sure Volume Shadow Copy is enabled and protected on Windows if you intend to rely on rollback.

Week one: triage by Storyline

1. Open each threat with its Storyline and attack tree: initial process, children, files written, network connections.
2. Decide true or false positive, and record the reason; tune exclusions narrowly.
3. Use Purple AI or PowerQuery to ask the scoping question: which other devices saw the same hash, command line or domain?

Every day: respond and measure

Use the mitigation actions in proportion: kill and quarantine for single-host malware, network isolation when you suspect hands-on-keyboard activity, rollback for file damage when shadow copies are intact. Automate the repeatable responses with Singularity Hyperautomation and keep an analyst approval step for disruptive actions. Track time to triage and false positive rate per detection type; AI-assisted triage should reduce the first without raising the second.

Where it stops

• Rollback is not backup. It is Windows only and depends on shadow copies that attackers routinely delete.
• Local decisions can be wrong. An on-device verdict that blocks a legitimate business tool needs a fast exception process.
• AI verdicts need checking. Purple AI's conclusions are a starting point; the evidence behind them must be read.
• Agent coverage. Unmanaged and unsupported devices remain blind spots, as with any EDR.

How it comes up in interviews

• "Compare two EDR platforms you have used." Talk about where decisions are made, telemetry retention, query language, response actions and rollout safety, not marketing claims.
• "Ransomware hit 40 laptops. What can your EDR do, and what can it not?" Contain, kill, roll back where shadow copies survive, then restore from real backups.
• "How would you evaluate an AI SOC assistant?" Measure accuracy against labelled past incidents, check its reasoning, and keep humans approving disruptive actions.

Sources

Checked on 13 November 2026: SentinelOne RSAC 2026 announcement (23 March 2026); SentinelOne Form 8-K filed 8 September 2025 and Form 10-Q for the quarter ended 31 October 2025 (Prompt Security and Observo acquisitions); SentinelOne Purple AI MCP server repository (Sentinel-One/purple-mcp); SentinelOne press release on PingSafe (3 January 2024); SentinelOne platform overview.