AI SOC Solution

The AI SOC Solution is an end-to-end security operations package powered by Hero AI. Alerts and reported phishing email become Case Management records (prefix CASE-); playbooks enrich, correlate, route, and support analyst triage in one place.

Choose Your Path

If You Want To...	Start Here
Understand what AI SOC is and how the workflow runs	Workflow at a Glance
Run your first investigation (AI assisted, agentic, or review after routing)	Getting Started
Install and configure the solution	Installing and Configuring AI SOC Solution
Enable agentic investigation after import (routing rules)	Getting Started — Enable Agentic Investigation After Import
Understand data flow (diagrams)	Architecture and Data Flow
Look up playbook flows and triggers	Playbook Flow Reference
Connect a new alert source	Choose Your Ingestion Path
Do daily analyst work	Operations and Guidance
Learn applications and record layout	AI SOC Applications
Fix an issue	Troubleshooting

Workflow at a Glance

Step	What Happens	Learn More
1. Ingest	Webhook, cron, or email playbooks receive alerts or phishing reports	Choose Your Ingestion Path
2. Normalize	Ingest Alert/Email to CASE Record creates or updates CASE- records	Architecture and Data Flow
3. Enrich	Threat intelligence and knowledge base articles attach to the record	Threat Intelligence (TI)
4. Evaluate	Correlation, rules engine, and Hero AI verdict when gates are complete	Understanding Verdict Generation
5. Investigate	Analysts claim the case with Claim Case and investigate on Case Investigation: AI Assisted (Generate Investigation Plan, then run steps), Agentic (Re-investigate on Investigation when Analysis Mode is Agentic, or a Signal Routing Rule), or review after routing (agentic investigation already completed)	Getting Started, Investigation Plan Workflow, Building Routing Rule Playbooks
6. Route / automate	Signal Routing Rules trigger Rule-Execute playbooks; repeat patterns use playbooks built from prior investigations	Building Routing Rule Playbooks, Creating Automation
7. Resolve	Status, classification, and closure per tenant playbooks and analyst action	Case Management (CASE)

Analyst entry point: Case Management → Case Investigation (Investigation, Remediation, and Automation widgets). Hands-on steps: Getting Started.

What Is in the Package

Area	Included	Guide
Triage and investigation	Case Management, Hero AI plans and verdicts; AI Assisted, Automated, and Agentic investigation	AI SOC Applications, Getting Started
Enrichment and routing	Threat Intelligence, Signal Routing Rules, Knowledge Base Articles	Configure Threat Intelligence Enrichment, Knowledge Base Articles (KB)
Ingestion builder	AI Ingestion application and workspace (alert sources)	AI SOC Ingestion
Reporting	ROI Calculator Workspace, plus Security Operations Overview and Analyst Triage Queue in the AI SOC workspace. The Reporting widget on a case generates an after-actions report	Dashboards and Reports
Automation	Prebuilt playbooks, assets, dashboards; agentic investigation via AI SOC - Trigger Analysis Agent via Routing Rule (routing rules created post-import)	Playbook Types and Usage, Building Routing Rule Playbooks
Tenant connectivity	AI SOC Tenant Configuration	Configure Custom Assets

Key Capabilities

Capability	Summary
Ingestion	Multi-source alerts (webhook, API, cron); phishing email processing; Turbine Schema normalization
Threat intelligence	Multi-provider enrichment; primary provider per observable type; manual and automatic enrichment
Hero AI	Investigation plans (generate, regenerate, progress detail), AI assisted and agentic investigation paths, verdicts (Malicious, Suspicious, Benign, Unknown), plans-to-playbooks, MITRE mapping, remediation guidance (manual execution)
Routing and playbooks	Condition-based rules; agentic investigation via AI SOC - Trigger Analysis Agent via Routing Rule; repeatable automated playbooks for cost-efficient handling of recurring alert types; Marketplace components
Case management	Unified CASE- lifecycle, evidence, escalation, metrics
Knowledge base	Scoped articles (Global, Signal Source, Signal Rule, Signal Name) linked by Matching Value
Correlation	Related signals and historical context on the case record

Next Steps

If You Want To...	Go To
Install and configure (assets, Hero AI, ingestion playbooks)	Installing and Configuring AI SOC Solution
Set roles and permissions	RBAC Considerations for AI SOC
Build connectors (AI Ingestion widget, Turbine Schema)	AI SOC Ingestion
Run your first investigation	Getting Started
Understand data flow and playbook handoffs	Architecture and Data Flow
Map playbook flows, triggers, and troubleshooting	Playbook Flow Reference
Learn the applications	AI SOC Applications
Author KB articles	Knowledge Base Articles (KB)
Do daily tasks	Operations and Guidance
Build routing rule playbooks	Building Routing Rule Playbooks
Monitor operations	Dashboards and Reports
Improve how you use AI SOC	Operational Best Practices
See example investigations	Example Scenarios
Connect your tools	Integration Examples
Fix issues	Troubleshooting

Role or Goal	Suggested Order
Installer / admin	Installing and Configuring AI SOC Solution → RBAC Considerations for AI SOC → Getting Started
Analyst	Getting Started → AI SOC Applications → Operations and Guidance
Architect / PS	Architecture and Data Flow → Playbook Types and Usage → Playbook Flow Reference
New alert source	Choose Your Ingestion Path → Configure Ingestion Playbooks or AI SOC Ingestion