--- title: SOC Interfaces slug: soc-interfaces docTags: createdAt: 2026-03-31T07:11:29.000Z --- This document lists the interface contracts available in the SOC Solutions Bundle. For general information about what interfaces are and how to use them, see [Working with Interfaces](docId\:LdKBcwTtB0SnEnaYR9Yri). For complete data model field definitions, see [Turbine Schema Reference (Classic SOC)](docId\:AbBcN4v4tRb5C1gqZvd2-). ## SOC Solutions Bundle Interfaces The SOC Solutions Bundle includes 20 interfaces for Security Operations Center workflows. Use these interfaces for alert triage, observable enrichment, email processing, and remediation actions. ### Alert to None v1.0.2 **Purpose**: Processes an alert object without producing output. Use this interface for alert ingestion workflows where you process alerts without transforming them. **Input schema**: | Field | Type | Required | Description | | ---------------------------------------------------------- | ---------------- | -------- | -------------------------------------------- | | `alert` | object | Yes | Alert object | | `alert.alert_categories` | array of strings | No | Alert categories | | `alert.alert_created_timestamp` | string | No | When the alert was created | | `alert.alert_description` | string | No | Alert description | | `alert.alert_end_timestamp` | string | No | Alert end time | | `alert.alert_impacted_hostnames` | array of strings | No | Affected hostnames | | `alert.alert_impacted_ip_addresses` | array of strings | No | Affected IP addresses | | `alert.alert_impacted_usernames` | array of strings | No | Affected usernames | | `alert.alert_ingested_timestamp` | string | No | When alert was ingested | | `alert.alert_mitre_attack_tactic_technique` | array of objects | No | MITRE ATT\&CK mappings | | `alert.alert_mitre_attack_tactic_technique.tactics` | array | No | Tactic information | | `alert.alert_mitre_attack_tactic_technique.technique` | object | No | Technique details with `name`, `uid` | | `alert.alert_mitre_attack_tactic_technique.technique.name` | string | No | Technique name | | `alert.alert_mitre_attack_tactic_technique.technique.uid` | string | No | Technique UID | | `alert.alert_mitre_attack_tactic_technique.version` | string | No | ATT\&CK version | | `alert.alert_organization` | string | No | Organization identifier | | `alert.alert_originating_files` | array of objects | No | Files associated with alert | | `alert.alert_originating_files.content` | object | No | File content (base64 or turbine\_attachment) | | `alert.alert_originating_files.file_hashes` | array | No | Hash information | | `alert.alert_originating_files.observables` | array | No | Observable data | | `alert.alert_permalink` | string | No | Link to alert details | | `alert.alert_provider` | string | No | Alert source provider | | `alert.alert_risk_score` | integer | No | Risk score | | `alert.alert_rules` | array | No | Rules that triggered the alert | | `alert.alert_severity` | string | No | Alert severity level | | `alert.alert_start_timestamp` | string | No | Alert start time | | `alert.alert_title` | string | No | Alert title | | `alert.alert_uid` | string | No | Unique alert identifier | | `alert.observables` | array | No | Observable entities | | `alert.raw_alert` | object | No | Raw alert data | **Output schema**: Empty object (no output) **Use cases**: - Alert ingestion pipelines - Alert logging and archival - Alert forwarding without transformation *** ### Array of Alerts to None v1.0.2 **Purpose**: Processes an array of alerts without producing output. Use this interface for bulk alert processing. **Input schema**: | Field | Type | Required | Description | | -------- | ---------------------- | -------- | --------------------------------- | | `alerts` | array of alert objects | Yes | Array of alert objects to process | **Output schema**: Empty object (no output) **Use cases**: - Bulk alert ingestion - Alert batch processing - Alert archival workflows *** ### Array of Simple Observable to None v1.0.2 **Purpose**: Processes an array of simple observable objects without producing output. **Input schema**: | Field | Type | Required | Description | | -------------------------------- | ---------------- | -------- | ---------------------------------- | | `observables` | array of objects | Yes | Array of simple observable objects | | `observables[].observable_type` | string | Yes | Type of observable | | `observables[].observable_value` | string | Yes | Observable value | **Output schema**: Empty object (no output) **Use cases**: - Bulk observable ingestion - Observable logging - Observable forwarding *** ### Simple Observable to None v1.0.2 **Purpose**: Processes a simple observable without producing output. **Input schema**: | Field | Type | Required | Description | | ----------------------------- | ------ | -------- | ------------------ | | `observable` | object | No | Observable object | | `observable.observable_type` | string | No | Type of observable | | `observable.observable_value` | string | No | Observable value | **Output schema**: Empty object (no output) **Use cases**: - Observable logging - Observable ingestion - Observable forwarding *** ### Phishing Email Report to None v1.0.2 **Purpose**: Processes phishing email report objects without producing output. **Input schema**: | Field | Type | Required | Description | | ----------------------- | ------ | -------- | -------------------------- | | `phishing_email_report` | object | No | Phishing email report data | **Output schema**: Empty object (no output) **Use cases**: - Phishing report ingestion - Phishing report logging - Phishing report archival *** ### Alert Triage Ingestion to Array of Alert v1.0.2 **Purpose**: Converts triage ingestion data into an array of standardized alert objects. **Input schema**: Triage ingestion format (specific structure) **Output schema**: | Field | Type | Required | Description | | -------- | ---------------------- | -------- | --------------------------------------------------------------- | | `alerts` | array of alert objects | No | Array of standardized alert objects that match the Alert schema | **Use cases**: - Bulk alert ingestion - Alert normalization from multiple sources - Alert triage workflows *** ### Simple Observable to Enrichment v1.0.2 **Purpose**: Converts a simple observable into an enrichment object that includes threat intelligence data. **Input schema**: | Field | Type | Required | Description | | -------------------------------- | ------ | -------- | ------------------------------------------------------ | | `observable` | object | Yes | Observable object | | `observable.observable_metadata` | object | No | Additional metadata | | `observable.observable_type` | string | Yes | Type of observable (such as "ip", "domain", or "hash") | | `observable.observable_value` | string | Yes | The observable value | **Output schema**: | Field | Type | Required | Description | | --------------------------------- | ------ | -------- | ------------------------------------------------------- | | `enrichment` | object | No | Enrichment object | | `enrichment.enrichment_context` | string | No | Context information | | `enrichment.enrichment_permalink` | string | No | Link to enrichment details | | `enrichment.enrichment_provider` | string | No | Enrichment data provider name | | `enrichment.enrichment_raw_data` | string | No | Raw enrichment data | | `enrichment.enrichment_timestamp` | string | No | When enrichment was retrieved | | `enrichment.enrichment_type` | string | No | Type of enrichment (such as "location" or "reputation") | | `enrichment.enrichment_verdict` | string | No | Reputation verdict | **Use cases**: - Threat intelligence enrichment - Observable reputation checking - Security context gathering *** ### Simple Observable to Observable v1.0.2 **Purpose**: Converts a simple observable into a full observable object with enrichment capabilities. **Input schema**: | Field | Type | Required | Description | | -------------------------------- | ------ | -------- | ------------------- | | `observable` | object | No | Observable object | | `observable.observable_type` | string | No | Type of observable | | `observable.observable_value` | string | No | Observable value | | `observable.observable_metadata` | object | No | Additional metadata | **Output schema**: | Field | Type | Required | Description | | ------------ | ------ | -------- | --------------------------------------------- | | `observable` | object | No | Full observable object with enrichment fields | **Use cases**: - Observable normalization - Observable enrichment preparation - Data structure standardization *** ### Text to Array of Observables v1.0.2 **Purpose**: Extracts observables from text content and returns them as an array. **Input schema**: | Field | Type | Required | Description | | ------------ | ------ | -------- | ------------------------------------- | | `text_value` | string | Yes | Text content to parse for observables | **Output schema**: | Field | Type | Required | Description | | -------------------------------- | ---------------- | -------- | ------------------------------ | | `observables` | array of objects | No | Array of extracted observables | | `observables[].observable_type` | string | No | Type of extracted observable | | `observables[].observable_value` | string | No | The extracted value | **Use cases**: - Email body parsing - Log file analysis - Text extraction from documents - IOC extraction from reports *** ### Object to Alert v1.0.2 **Purpose**: Converts a generic object into a standardized alert object. **Input schema**: | Field | Type | Required | Description | | -------- | ------ | -------- | ---------------------------------------- | | `object` | object | No | Generic object with alert-related fields | **Output schema**: | Field | Type | Required | Description | | ------- | ------ | -------- | ----------------------------------------------- | | `alert` | object | No | Standardized alert object matching Alert schema | **Use cases**: - Alert normalization from various sources - Custom alert format conversion - Alert standardization *** ### Error to Enrichment v1.0.2 **Purpose**: Converts error information into an enrichment object for error tracking and analysis. **Input schema**: | Field | Type | Required | Description | | ------- | ------ | -------- | ----------------- | | `error` | object | No | Error information | **Output schema**: | Field | Type | Required | Description | | ------------ | ------ | -------- | ------------------------------------------ | | `enrichment` | object | No | Enrichment object containing error context | **Use cases**: - Error tracking - Error enrichment - Error analysis workflows *** ### Email to Email v1.0.2 **Purpose**: Converts email objects while preserving the email structure. Used for email processing workflows. **Input schema**: | Field | Type | Required | Description | | ---------------------------------------- | ---------------- | -------- | ---------------------------------------- | | `email` | object | Yes | Email object | | `email.email_bcc_addresses` | array of strings | No | BCC recipients | | `email.email_body` | string | No | Email body content | | `email.email_cc_addresses` | array of strings | No | CC recipients | | `email.email_delivery_timestamp` | string | No | Delivery timestamp | | `email.email_from_address` | string | No | Sender address | | `email.email_headers` | array of objects | No | Email headers | | `email.email_headers[].header_key` | string | No | Header name | | `email.email_headers[].header_value` | string | No | Header value | | `email.email_html_body` | string | No | HTML body content | | `email.email_message_id` | string | No | Message ID | | `email.email_mime_parts` | array of objects | No | MIME parts | | `email.email_mime_parts[].content` | object | No | Content (base64 or turbine\_attachment) | | `email.email_mime_parts[].file_name` | string | No | File name | | `email.email_mime_parts[].is_attachment` | boolean | No | Whether it is an attachment | | `email.email_mime_parts[].mime_type` | string | No | MIME type | | `email.email_organization` | string | No | Organization identifier | | `email.email_origination_timestamp` | string | No | Origination time | | `email.email_reply_to_addresses` | array of strings | No | Reply-to addresses | | `email.email_subject` | string | No | Email subject | | `email.email_text_body` | string | No | Plain text body | | `email.email_to_addresses` | array of strings | No | TO recipients | | `email.observables` | array | No | Observable entities extracted from email | | `email.raw_email` | string | No | Raw email content | **Output schema**: | Field | Type | Required | Description | | ------- | ------ | -------- | -------------------------------------------- | | `email` | object | No | Transformed email object with same structure | **Use cases**: - Email processing workflows - Email transformation - Email forwarding - Email analysis *** ### Turbine Attachment to Email v1.0.2 **Purpose**: Converts a Turbine attachment object into an email object format. **Input schema**: | Field | Type | Required | Description | | -------------------- | ------ | -------- | ------------------------- | | `turbine_attachment` | object | No | Turbine attachment object | **Output schema**: | Field | Type | Required | Description | | ------- | ------ | -------- | ---------------------- | | `email` | object | No | Email object structure | **Use cases**: - Attachment to email conversion - Email reconstruction from attachments - Email processing workflows *** ### File to File v1.0.2 **Purpose**: Converts file objects while preserving file structure. **Input schema**: | Field | Type | Required | Description | | ------ | ------ | -------- | ------------------------------------------ | | `file` | object | No | File object with file metadata and content | **Output schema**: | Field | Type | Required | Description | | ------ | ------ | -------- | ----------------------- | | `file` | object | No | Transformed file object | **Use cases**: - File processing workflows - File transformation - File forwarding *** ### Header to Header v1.0.2 **Purpose**: Converts header objects (email or HTTP headers). **Input schema**: | Field | Type | Required | Description | | -------- | ------ | -------- | ------------- | | `header` | object | No | Header object | **Output schema**: | Field | Type | Required | Description | | -------- | ------ | -------- | ------------------------- | | `header` | object | No | Transformed header object | **Use cases**: - Header processing - Header transformation - Header analysis *** ### MIME Part to MIME Part v1.0.2 **Purpose**: Converts MIME part objects while preserving structure. **Input schema**: | Field | Type | Required | Description | | ----------- | ------ | -------- | ---------------- | | `mime_part` | object | No | MIME part object | **Output schema**: | Field | Type | Required | Description | | ----------- | ------ | -------- | ---------------------------- | | `mime_part` | object | No | Transformed MIME part object | **Use cases**: - MIME part processing - Email attachment handling - Content extraction *** ### Phishing Triage Email Ingestion to Array of Phishing Email Report v1.0.2 **Purpose**: Converts phishing triage email ingestion data into an array of phishing email reports. **Input schema**: Phishing triage ingestion format **Output schema**: | Field | Type | Required | Description | | ------------------------ | ---------------- | -------- | -------------------------------------- | | `phishing_email_reports` | array of objects | No | Array of phishing email report objects | **Use cases**: - Bulk phishing email processing - Phishing triage workflows - Phishing report generation *** ### Block/Unblock Observable Remediation Action **Purpose**: Performs block or unblock actions on observables (such as IPs and domains) in security systems. **Input schema**: | Field | Type | Required | Description | | ----------------- | ------ | -------- | --------------------------------------------- | | `observable` | string | Yes | The observable value to block or unblock | | `observable_type` | string | Yes | Type of observable (such as "ip" or "domain") | | `action` | string | Yes | Action to perform ("block" or "unblock") | **Output schema**: | Field | Type | Required | Description | | --------------- | ------ | -------- | -------------------------------------------- | | `block_message` | string | No | Response message from the remediation action | **Use cases**: - IP address blocking/unblocking - Domain blocking - Threat containment workflows - Security control automation *** ### Enable/Disable User Account Remediation Action **Purpose**: Enables or disables user accounts in identity management systems. **Input schema**: | Field | Type | Required | Description | | -------------- | ------ | -------- | ------------------------------------------------ | | `user_account` | string | Yes | The user account identifier to enable or disable | | `action` | string | Yes | Action to perform ("enable" or "disable") | **Output schema**: | Field | Type | Required | Description | | ------------------ | ------ | -------- | ---------------------------------------- | | `response_message` | string | No | Response message from the account action | **Use cases**: - Account remediation - Incident response - Access control automation - User account management *** ### Isolate/Rejoin Hosts Remediation Action **Purpose**: Isolates or rejoins hosts in network security systems. **Input schema**: | Field | Type | Required | Description | | -------- | ------ | -------- | ----------------------------------------- | | `host` | string | Yes | Host identifier to isolate or rejoin | | `action` | string | Yes | Action to perform ("isolate" or "rejoin") | **Output schema**: | Field | Type | Required | Description | | ------------------ | ------ | -------- | -------------------------------------------- | | `response_message` | string | No | Response message from the remediation action | **Use cases**: - Host isolation during incidents - Network containment - Incident response automation - Security control workflows ***