SentinelOne has announced a series of new innovations and integrations with Amazon Web Services (AWS) at AWS re:Invent 2025, aiming to accelerate AI initiatives and enhance AI-powered security through advanced data utilization for organizations leveraging AWS cloud infrastructure.
These announcements include advanced integrations between SentinelOne’s AI-native Singularity cybersecurity platform and AWS Security Hub, as well as with Amazon CloudWatch. Additionally, SentinelOne’s new Purple AI MCP Server and the Observo AI data pipeline are now available in the AWS Marketplace. These offerings are designed to streamline how customers procure, integrate, and leverage SentinelOne’s AI and data innovations.
Organizations operating on AWS can utilize these integrations and new offerings to secure their cloud workloads, endpoints, identities, and GenAI applications. The solutions offer unified visibility, agentic AI capabilities, and intelligent data pipelines, which contribute to reduced costs, simplified operations, and accelerated time-to-value for security outcomes.
Ely Kahn, chief product officer at SentinelOne, commented on the strategic importance of data in security. “Security data is the fuel that powers AI-driven, autonomous security. SentinelOne in collaboration with AWS has long believed that open platforms, open data standards like OCSF, and intelligent, unified data lakes are key to protecting customers’ ever growing attack surface – from endpoints to the cloud to AI,” Kahn stated. He added that the collaboration at re:Invent aims to “accelerate the adoption and efficacy of AI defenses by making it easy for customers to intelligently and cost effectively harness security data across their entire digital footprint.”
Building on their shared vision for security in the AI era, SentinelOne and AWS are expanding their collaborative efforts. The AWS Security Hub integration with Singularity AI SIEM allows organizations to stream prioritized AWS Security Hub findings into SentinelOne’s Singularity AI SIEM. Here, these findings are automatically correlated with endpoint, identity, and AI telemetry, providing unified context to automate responses, accelerate investigations, and remediate modern threats.
An integration with new Amazon CloudWatch capabilities enables bidirectional data flows between the Singularity Platform and Amazon CloudWatch. This provides enhanced visibility across attack surfaces, allows for correlations to identify and respond to potential threats, and offers greater flexibility for enriching and storing security data, leveraging the OCSF open data standard.
To accelerate AI-powered security through faster data onboarding, SentinelOne is introducing support for AWS IAM temporary delegation. This feature offers a one-click setup experience, automatically configuring the necessary IAM resources to securely ingest AWS Security Hub data, which can then be correlated and enriched with endpoint, identity, and AI telemetry with full customer control.
Following the introduction of the Purple AI MCP server at SentinelOne’s OneCon 2025 event and the recent acquisition of Observo AI, SentinelOne is expanding its offerings in the AWS Marketplace. The Purple AI MCP Server, now available on AWS Marketplace, extends the capabilities of SentinelOne’s Purple AI, acting as a universal translator and intelligence hub. It facilitates secure integration between the Singularity Platform and any AI framework or large language model, empowering developers and partners to build custom agentic AI experiences on AWS and beyond.
SentinelOne’s Observo AI data pipeline is also now available on the AWS GenAI Marketplace. Observo AI, which uses AI/ML models, aims to reduce security and observability costs significantly while resolving incidents faster. It achieves this by intelligently reducing data noise before ingestion, ensuring customers primarily pay for high-value data in their SIEM and APM tools. Observo AI offers native support for various AWS services, including Amazon CloudWatch, Amazon S3, Amazon Kinesis Data Firehose, Amazon Kinesis Data Streams, Amazon Simple Queue Service (SQS), Amazon Simple Notification Service (SNS), AWS Lambda, Elastic Load Balancing (ELB), Amazon CloudFront, and Amazon Security Lake.
The collaboration between SentinelOne and AWS emphasizes co-innovation and a shared focus on customer outcomes. SentinelOne’s AI-powered Singularity platform integrates with more than 20 AWS services, co-building solutions that translate shared telemetry into action through unified visibility, autonomous detection and response, and secure GenAI adoption. This approach aims to provide faster time-to-value through native integrations and AWS Marketplace procurement, ensuring interoperability across endpoints, cloud workloads, identities, and data. The objective is to reduce complexity, shorten response times, and assist organizations in securely building and scaling AI initiatives while automating and modernizing security operations.
All new innovations, integrations, and AWS Marketplace listings are either currently available or planned for general availability this week at AWS re:Invent 2025.
