20 Hottest Cybersecurity Products At RSAC 2023

SentinelOne Threat Hunting Tool

During the first day of RSAC 2023, SentinelOne announced a new threat hunting tool for its Singularity platform that utilizes a large language model (LLM) in an effort to dramatically improve productivity for security analysts. SentinelOne is referring to the new generative AI-powered threat hunting tool as “Purple AI,” the company told CRN.

Analysts will be able to use the new generative AI interface in the Singularity Skylight platform to ask questions about threats in a customer’s environment—for instance, “Is a certain threat actor present in this environment?” or “Are there threat actors affiliated with China in my environment?” The ability to use natural language to query a system will offer massive time-savings to analysts and will allow security teams to respond to more alerts and catch more attacks, said Ric Smith, chief product and technology officer at SentinelOne.

Ultimately, a main goal of implementing generative AI technology in this way is around “making threat hunting more accessible,” he told CRN. With existing threat hunting platforms, “it’s pretty daunting” to use them, Smith said. With the addition of this generative AI technology, however, SentinelOne believes the technology can now enable security operations teams to scale up their threat-hunting activities, he said.

The large language model that’s helping to power the new threat hunting tool leverages both open-source and proprietary offerings in the space, Smith said. One of the LLMs being utilized by SentinelOne is OpenAI’s GPT-4, the company confirmed to CRN. SentinelOne is also training the model on its own data and is doing “quite a bit of fine-tuning” on the LLM to customize it for the security domain, Smith said.

The new SentinelOne threat hunting tool will initially be offered as an add-on to the Singularity Skylight platform and is now in limited preview. Details about wider availability are not being released yet.