---
title: AI SOC Applications
slug: solutions/ai-soc-applications
docTags: 
createdAt: 2026-02-17T06:44:55.199Z
---

AI SOC includes the following applications. You can find them in **Applications & Applets** after install. Each application defines a data model and record layout that organizes how you view and work with records. For **role-based access control** on components and orchestration (including **legacy** versus **enhanced** RBAC), see [RBAC Considerations for AI SOC](docId\:Jl6Dsw0QjBkPq_iOJDgLp).

- **Case Management** (CASE): Primary application for triage and investigation with Hero AI. Ingestion creates records here (tracking prefix **CASE-**). The **Case Analysis** tab includes **Controls** (SLA, **Claim**, **Unclaim**), signal and case fields, evidence areas, and the **AI Analysis** widget (shown as **AI Alert Analysis** on the record). The **Support** tab includes **Analysis Mode** (**Manual** or **Autonomous**), **Analysis Agent Request ID** and **Analysis Agent Session** tracking fields, and manual actions. Timelines, audit, and routing rule results live on additional tabs. See [Case Management (CASE)](docId\:sDpESfT6Lsyz0zfrn_hok) and [Getting Started](docId\:p7QJQUayeKczHPxEpPWcp) for manual plan, **Re-investigate**, and routing-rule investigation paths.
- **Threat Intelligence** (TIA): Application for storing observable enrichment results (package name **Threat Intelligence Artifact**). Records display with an **Observable** panel that anchors key fields, plus enrichment results and risk scores.
- **Signal Routing Rules** (RULE): Application for defining routing logic that maps records to playbooks (package name **Routing Rule**). Records use a tabbed layout for Rule data and configuration. For compatible playbooks and manual association, see [Building Routing Rule Playbooks](docId\:vEiFYG4oYWkQ3DcMMwjXi).
- **Knowledge Base Articles** (KB): Investigation guidance with **Scope** (**Global**, **Signal Source**, **Signal Rule**, **Signal Name**) and **Matching Value**. See [Knowledge Base Articles (KB)](docId\:NTgNxpVESzjGY_LlqoJmF) for how to create articles and [KB Article Best Practices for Plan Generation](docId:7Zdgwrtvm6yI0lUnJL4JP).
- **AI Ingestion** (AI): Application for building and tracking alert ingestion configurations (separate **AI Ingestion Workspace**). Each record represents an ingestion setup (for example, vendor product, API specification uploaded, components generated). The custom widget guides you through creating connector components and ingestion pipelines; use the **Audit** tab to review configurations and activity. For the full workflow, see **AI SOC Ingestion**.

These walkthroughs explain where to start in each application, which panels to prioritize when viewing records, and the actions to use for triage and investigation.