AI SOC Applications

AI SOC includes the following applications. You can find them in Applications & Applets after install. Each application defines a data model and record layout that organizes how you view and work with records. For role-based access control on components and orchestration (including legacy versus enhanced RBAC), see RBAC Considerations for AI SOC.

Case Management (CASE): Primary application for triage and investigation with Hero AI. Ingestion creates records here (tracking prefix CASE-). The record opens with a Case Header, a sidebar (Incident Response SLA, Investigation Type, Case Actions, Case Details, Flags), and the Case Investigation tab (Case Summary, Case Timeline, Threat Intelligence, Investigation, Remediation, Automation). Analysis Mode is AI Assisted, Automated, or Agentic. See Case Management (CASE) and Getting Started.

Threat Intelligence (TIA): Application for storing observable enrichment results (package name Threat Intelligence Artifact). Records display with an Observable panel that anchors key fields, plus enrichment results and risk scores.

Signal Routing Rules (RULE): Application for defining routing logic that maps records to playbooks (package name Routing Rule). Records use a tabbed layout for Rule data and configuration. For compatible playbooks and manual association, see Building Routing Rule Playbooks.

Knowledge Base Articles (KB): Investigation guidance with Scope (Global, Signal Source, Signal Rule, Signal Name) and Matching Value. See Knowledge Base Articles (KB) for how to create articles and KB Article Best Practices for Plan Generation.

AI Ingestion (AI): Application for building and tracking alert ingestion configurations (separate AI Ingestion Workspace). Each record represents an ingestion setup (for example, vendor product, API specification uploaded, components generated). The custom widget guides you through creating connector components and ingestion pipelines; use the Audit tab to review configurations and activity. For the full workflow, see AI SOC Ingestion.

These walkthroughs explain where to start in each application, which panels to prioritize when viewing records, and the actions to use for triage and investigation.