Singularity Data Lake, Singularity AI SIEM and Purple AI are SentinelOne’s data and AI security operations products, licensed alongside the endpoint-metered Singularity packages. Data Lake is SentinelOne’s security data store, and AI SIEM is built on it. SentinelOne says Data Lake separates storage from compute and “prices on monthly average ingestion, not daily limits”.[1] Purple AI is the platform’s AI security analyst. Its conversational capabilities appear in the endpoint packages, and its agentic, autonomously initiated investigations are metered in Singularity Credits.[5] Two newer product families from acquisitions, Prompt Security and Observo, have their own Solutions Addenda under the Master Subscription Agreement (MSA).[12] None of these products has a public price.
Editions
| Product | What it is (vendor description) | How it is licensed |
|---|---|---|
| Singularity Data Lake | Security data lake with decoupled storage and compute[1] | Monthly average ingestion[1] |
| Singularity Data Lake for Log Analytics | Log analytics on the same data lake, all data kept hot[2] | Storage and compute decoupled; no public unit[2] |
| Singularity AI SIEM | Cloud-native SIEM with Hyperautomation and AI Data Pipelines[3] | By quote; data pipeline bundled[4] |
| Purple AI | Agentic AI security analyst[6] | Attached licence; agentic investigations draw Credits[4][5] |
| Prompt Security products | Products identified as Prompt products in a Quote[9] | Limited as set forth in the Purchase Order[9] |
| Observo products | Products identified as Observo products in a Quote[10] | Limited as set forth in the Purchase Order[10] |
Retention included with endpoint packages
The endpoint packages include a fixed telemetry retention period. Singularity Complete includes 14 days, and Commercial and Enterprise include 90 days.[7] Longer retention, and third-party logs, are the job of Singularity Data Lake. Singularity Data Lake for Log Analytics keeps data hot and queryable, and SentinelOne says every log stays queryable “whether it’s from today or two years ago”.[2]
AI SIEM and AI Data Pipelines
SentinelOne acquired Observo AI and has built its pre-ingestion data pipeline into Singularity AI SIEM. The March 2026 announcement describes the pipeline as “Bundled as part of Singularity AI SIEM”.[4] The August 2026 AI SIEM datasheet calls it Singularity AI Data Pipelines (formerly Observo AI) and says it filters and normalizes telemetry before it is stored, so that the SOC “only pays for and processes what actually matters”.[3] Observo products that are sold on their own, outside AI SIEM, are governed by the Observo Solutions Addendum.[10]
Purple AI tiers
The endpoint packages include an “AI Security Assistant” from Singularity Complete upwards. The “Agentic AI SOC Analyst” is an add-on for Complete and Commercial and is included in Enterprise.[7] SentinelOne’s March 2026 release states that Purple AI Auto Investigations “is available for all Purple AI Analyst customers”. The same release reports that Purple AI was included in over 50% of all licences sold in the fourth quarter of fiscal 2026. Both statements show that Purple AI is sold as a licence line attached to platform subscriptions.[4] The June 2026 release introduced Purple AI Agentic Investigation, in which zero-click investigations run without an analyst starting them. It is metered in Singularity Credits.[5]
Metrics
| SentinelOne term | Catalog row | Applies to | What SentinelOne says |
|---|---|---|---|
| Monthly average ingestion | Monthly average ingestion | Data Lake, AI SIEM | Usage is measured as an average over the month and reviewed at renewal.[1] |
| Singularity Credit | Singularity Credit | Purple AI Agentic Investigation and other AI-powered work | A unified currency drawn down across AI-powered work in the platform.[5] |
| Endpoint | Endpoint | AI Security Assistant and Agentic AI SOC Analyst when bought within a package | Package features priced per endpoint.[7] |
The ingestion metric has no published unit or tier structure. The page describes the measurement method (a monthly average) but gives no GB bands. SentinelOne has not published a Credit price, a Credit allotment size or a Credit cost per investigation.
Counting / floors
Monthly average ingestion (vendor page undated; as published on 2026-09-30). SentinelOne prices on monthly average ingestion rather than daily limits. A spike in data volume during an incident therefore does not immediately trigger overage fees. Usage is averaged over the month and reviewed at renewal.[1] For true-up purposes the unit to track is the monthly average, not the peak day. Reconciliation happens at renewal rather than on each overage. Catalog proof: Data Lake priced on monthly average ingestion, reviewed at renewal.
Decoupled storage. Singularity Data Lake for Log Analytics decouples storage from compute, so retention scales independently from analytics workloads. SentinelOne says this “eliminates the ingestion-based pricing spikes” common in legacy SIEM and log management platforms.[2] The Purchase Order is the only place where the retention commitment and the ingestion commitment are quantified.
Singularity Credits (effective 2026-06-17). Credits are drawn down by AI-powered work, starting with Purple AI Agentic Investigation. SentinelOne gave customers a complimentary allotment to trial the capability. During the trial, investigations use Credits but customers are not charged, and after the trial Credits can be bought through partners, direct billing and eCommerce.[5] Activation is admin-controlled, role-based and reversible, and “consumption guardrails” keep usage and downstream cost in the hands of those with the right authority.[5] Catalog proof: Singularity Credits are drawn down by AI-powered work. For the general consumption model, see subscription and consumption licensing.
Prompt and Observo (effective 2026-05-14). Both addenda grant a licence for internal business operations that “is limited as set forth in a valid Purchase Order”. Neither names a metric.[9][10] Catalog proof: Prompt and Observo licences are limited as set out in the Purchase Order.
Data rights and retention
The MSA separates Customer Data from System Data. Customer Data is data ingested from Customer Endpoints or otherwise provided by or for the customer. System Data covers threat data, detections and indicators of compromise that SentinelOne compiles and may use for security, product and research purposes.[11] Access to associated or retained data is available only during the Subscription Term.[11] Catalog proof: Retained data is available only during the Subscription Term. The DataSet Terms, published in the consolidated GSA agreement, cover SentinelOne’s earlier DataSet log product. They provide that Customer Data is deleted periodically within 30 days of the configured retention period. They also allow the customer to request an export before its use of DataSet ends.[8] The standalone legal index no longer lists DataSet Terms.[12]
Virtualization & partitioning
Ingestion and Credit metrics do not depend on the hosts that produce the data, so virtualization rules do not apply to them. Where a package feature is bought per Endpoint, the Endpoint definition in the MSA, which covers virtual devices and containers, applies.[11]
Cloud / BYOL
All the products on this page are SaaS services operated by SentinelOne, so bring-your-own-license does not apply. Purple AI can be extended to external agent frameworks through the Purple AI MCP Server.[6] The retrieved documents do not say whether such external use consumes Credits.
Programs
- Purple AI Agentic Investigation trial. A complimentary Credit allotment for new and existing customers, with no payment method required.[5]
- Evaluation. The MSA evaluation terms (up to 30 days) apply to all Solutions, including data and AI products.[11]
Out of scope
This page does not cover Data Lake or AI SIEM price points, ingestion bands, retention add-on prices or Credit rates, none of which are published. Prompt AI Agent Security and Prompt AI Red Teaming were announced in March 2026[4] and are licensed under the Prompt Security addendum; their metrics are not public. The Data Protection Addendum is not covered.