--- title: AI SOC for MSSP slug: solutions/ai-soc-for-mssp docTags: createdAt: 2026-04-28T00:00:00.000Z --- Use this guide set to deploy, operate, and validate AI SOC in a managed service provider (MSSP) model with client tenants and a central tenant. ## MSSP Mode Overview AI SOC for MSSP is an optional solution designed for multi-tenant architectures. While the AI SOC Core serves as the foundational solution running within each client tenant, the AI SOC for MSSP augments it with specialized multi-tenant capabilities. The MSSP Client Extension uses synchronization features to update the Central Tenant with Case Management records, Threat Intelligence Artifact Cache (TIAC) records, and periodic SOC reporting aggregates, creating a centralized Single Pane of Glass view. Rather than replacing the client's local Case Management, it facilitates centralized visibility and introduces MSSP-specific workflows. ## How AI SOC for MSSP Works AI SOC for MSSP deployment uses three solution layers: | Solution Layer | Install Tenant | Purpose | | -------------------------------- | -------------- | --------------------------------------------------------------------------------------------- | | **AI SOC Core Solution** | Client tenant | Base AI SOC applications, workflows, dashboards, and playbooks (26.2.0 or later) | | **AI SOC MSSP Client Extension** | Client tenant | Syncs case records, full TIAC records, and reporting aggregates from client to central tenant | | **AI SOC MSSP Central Solution** | Central tenant | Receives client records and maintains central case, TI cache, and SOC reporting views | :::hint{type="info"} **AI SOC MSSP Client Extension** uses two paths to the central tenant. **Case Management** records and **SOC reporting** aggregates go over the central **Ingest Record from Client** webhook. **Threat Intelligence Artifact Cache** records are created or updated over the Swimlane API using **PrivateToken**. What resides in the central tenant is the **Threat Intelligence Artifact Cache** (TI cache), **Central Case Management**, and **Central SOC Reporting**. ::: ## Architecture of MSSP Mode | Tenant Role | Primary Responsibility | Typical Data Scope | | -------------- | -------------------------------------------------------- | ------------------------------------------------------ | | Client tenant | Detect, triage, investigate, and resolve customer alerts | Single customer records and tenant-local operations | | Central tenant | Aggregate synchronized records across clients | Multi-client oversight and centralized reporting views | ![AI SOC MSSP data flow from client tenant to central tenant](https://api.archbee.com/api/optimize/n8uUzk0MM4uC57-zlHNtY/Qno3UafcVMdb6bbKDoR_B-20260825-140126.png) The **Ingest Record from Client** webhook receives two kinds of records: **Case Management** records and **SOC reporting** records. Full **Threat Intelligence Artifact Cache** records use the Swimlane API (**PrivateToken**), not the webhook. Client teams continue work in the client tenant; central is a single pane of glass. ## Tenant Roles ### Client Tenant - Receives and processes customer alerts using standard AI SOC workflows. - Runs triage and investigation in **Case Management**. - Configures core **AI SOC Tenant Configuration** (including **Private\_Token**) from **AI SOC Core Solution**. - Configures **AI SOC MSSP Client Configuration** and **AI SOC MSSP Central Sync** so case records, reporting aggregates, and TIAC records reach the central tenant (**Central\_Webhook\_URL**, **Client\_Name**, **Central\_Tenant\_ID**, **Central\_TIAC\_App\_ID**, webhook basic auth, and **PrivateToken**). - Includes **TIA Central Sync Fields** on the client **Threat Intelligence** application (**Support** tab, **Threat Intelligence Metadata**) so central TIAC create and update can write required metadata fields. - Disables the **Enrich TIA Record** (Create) flow in Core playbook **AI SOC Main** so the client does not re-enrich TIA observables that already exist in central **Threat Intelligence Artifact Cache**. - Runs **Case Record Monitoring** so Case Management updates post to the central webhook. This webhook path is required for case sync. - Runs **AI SOC MSSP - Reporting** and **SOC Reporting Sync** so periodic reporting aggregates post to the same central webhook. This path is required for **Central SOC Reporting**. - Synchronizes new or re-enriched Threat Intelligence (TI) data from the client tenant to the central tenant's Threat Intelligence Artifact Cache (TIAC) as full TIAC records (create or update) over the API. ### Central Tenant - Aggregates data across client tenants for MSSP oversight. - Uses the **Ingest Record from Client** webhook to receive case and report payloads (no separate central MSSP configuration assets in current packages). The only required central configuration is webhook authentication; playbooks, workspaces, and applications install with the package. - Provides centralized record visibility in **Central Case Management**. - Stores multi-tenant TI cache data in **Threat Intelligence Artifact Cache**. - Can mark TI cache records for client-side re-enrichment when enrichment must be refreshed. - Provides **Central SOC Reporting** and the **Central SOC Reporting Workspace** for cross-client aggregates, plus **Usage Statistics**. ## Flow Overview 1. Client tenant ingest and investigation workflows create or update records. 2. **Case Record Monitoring** sends Case Management records to the central **Ingest Record from Client** webhook. 3. **SOC Reporting Sync** periodically sends reporting aggregates to the same webhook. 4. Client TI automation creates or updates full **Threat Intelligence Artifact Cache** records in the central tenant over the API. 5. Central **Catch Records from Client** routes webhook payloads to **Upsert Central Case Management Record** or **Upsert Central Report Record**. 6. MSSP analysts use central applications and dashboards for cross-client monitoring. 7. Client teams continue remediation and case handling in their own tenant workflows. ## Choose Your Path | If You Need To... | Use This Guide | | ------------------------------------------------------------ | ------------------------------------------------------------------- | | Configure client and central tenants (assets, webhook, sync) | [Configure AI SOC for MSSP](docId\:AzfPz-c_qLu3ElVSZkLLw) | | Perform first deployment and baseline validation | [Getting Started for MSSP](docId\:ivvy6GXAjWc34xVMnNqC-) | | Add an additional customer environment | [Onboard a Client Tenant](docId\:fGkw7if8VsR9_hchdeXUS) | | Work day to day in the central tenant | [Use AI SOC for MSSP Central](docId\:gUalyzLQa-7ACfkpsZhCQ) | | Confirm data propagation and resolve sync failures | [Validate and Troubleshoot MSSP Sync](docId\:QYEsknwk-RnSc1w1uax_D) | ## Related AI SOC Guides | If You Want To... | Go To | | ---------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------- | | Run first investigation workflows in a client tenant | [Getting Started](docId\:p7QJQUayeKczHPxEpPWcp) | | Configure base AI SOC tenant assets (PAT, TI, correlation) | [Installing and Configuring AI SOC Solution](docId:_b7njxu5XnzYrjCnGQg5J) and [Configure Custom Assets](docId\:qDCKIJLolS_7DWZJgRBqK) | | Learn AI SOC applications and dashboards | [AI SOC Applications](docId\:UOSUZRpSl6hFe9d6Br5az) and [Dashboards](docId\:AAYntc5RuMVE6M_Xru_0_) | | Review operational and troubleshooting guidance | [Operations and Guidance](docId\:DsdGtAQeg95DSeAF2Iat-) and [Troubleshooting](docId\:cKnuXQV85k9lu0OCqV218) |