AI SOC Solution

The AI SOC Solution is an end-to-end security operations package powered by Hero AI. Alerts and reported phishing email become Case Management records (prefix CASE-); playbooks enrich, correlate, route, and support analyst triage in one place.

Choose Your Path

If You Want To...	Start Here
Install and configure the solution	Installing and Configuring AI SOC SolutionInstalling and Configuring AI SOC Solution
Enable agentic investigation after import	Getting Started — Enable Agentic Investigation After Import
Run your first investigation	Getting StartedGetting Started
Understand data flow (diagrams)	Architecture and Data FlowArchitecture and Data Flow
Look up playbook flows and triggers	Playbook Flow ReferencePlaybook Flow Reference
Connect a new alert source	Choose Your Ingestion Path
Do daily analyst work	Operations and GuidanceOperations and Guidance
Learn applications and record layout	AI SOC ApplicationsAI SOC Applications
Fix an issue	TroubleshootingTroubleshooting

Workflow at a Glance

Step	What Happens	Learn More
1. Ingest	Webhook, cron, or email playbooks receive alerts or phishing reports	Choose Your Ingestion Path
2. Normalize	Ingest Alert/Email to CASE Record creates or updates CASE- records	Architecture and Data FlowArchitecture and Data Flow
3. Enrich	Threat intelligence and knowledge base articles attach to the record	Threat Intelligence (TI)Threat Intelligence (TI)
4. Evaluate	Correlation, rules engine, and Hero AI verdict when gates are complete	Understanding Verdict GenerationUnderstanding Verdict Generation
5. Investigate	Analysts claim records and investigate in AI Alert Analysis using one of three approaches: AI assisted investigation (Hero AI plan; analyst runs steps), agentic investigation (Analysis agent via Re-investigate in AI Alert Analysis when Analysis Mode is Autonomous, or a Signal Routing Rule), or review after routing (agentic investigation already completed—review plan, verdict, and component results)	Getting StartedGetting Started, Investigation Plan WorkflowInvestigation Plan Workflow, Building Routing Rule PlaybooksBuilding Routing Rule Playbooks
6. Route / automate	Signal Routing Rules trigger Rule-Execute playbooks; repeat patterns use playbooks built from prior investigations	Building Routing Rule PlaybooksBuilding Routing Rule Playbooks, Creating AutomationCreating Automation
7. Resolve	Status, classification, and closure per tenant playbooks and analyst action	Case Management (CASE)Case Management (CASE)

Analyst entry point: Case Management → AI Alert Analysis panel (AI Analysis widget). Hands-on steps: Getting StartedGetting Started.

What Is in the Package

Area	Included	Guide
Triage and investigation	Case Management, Hero AI plans and verdicts; AI assisted investigation (manual plan) or agentic investigation (Analysis agent)	AI SOC ApplicationsAI SOC Applications, Getting StartedGetting Started
Enrichment and routing	Threat Intelligence, Signal Routing Rules, Knowledge Base Articles	Configure Threat Intelligence EnrichmentConfigure Threat Intelligence Enrichment, Knowledge Base Articles (KB)Knowledge Base Articles (KB)
Ingestion builder	AI Ingestion application and workspace (alert sources)	AI SOC IngestionAI SOC Ingestion
Reporting	SOC Reporting, ROI Calculator workspaces	DashboardsDashboards and Reports
Automation	Prebuilt playbooks, assets, dashboards; agentic investigation via AI SOC - Trigger Analysis Agent via Routing Rule (routing rules created post-import)	Playbook Types and UsagePlaybook Types and Usage, Building Routing Rule PlaybooksBuilding Routing Rule Playbooks
Tenant connectivity	AI SOC Tenant Configuration, Turbine Tenant Credentials	Configure Custom AssetsConfigure Custom Assets

Key Capabilities

Capability	Summary
Ingestion	Multi-source alerts (webhook, API, cron); phishing email processing; Turbine Schema normalization
Threat intelligence	Multi-provider enrichment; primary provider per observable type; manual and automatic enrichment
Hero AI	Investigation plans (generate, regenerate, progress detail), AI assisted and agentic investigation paths, verdicts (Malicious, Suspicious, Benign, Unknown), plans-to-playbooks, MITRE mapping, remediation guidance (manual execution)
Routing and playbooks	Condition-based rules; agentic investigation via AI SOC - Trigger Analysis Agent via Routing Rule; repeatable automated playbooks for cost-efficient handling of recurring alert types; Marketplace components
Case management	Unified CASE- lifecycle, evidence, escalation, metrics
Knowledge base	Scoped articles (Global, Signal Source, Signal Rule, Signal Name) linked by Matching Value
Correlation	Related signals and historical context on the case record

Next Steps

If You Want To...	Go To
Install and configure (assets, Hero AI, ingestion playbooks)	Installing and Configuring AI SOC SolutionInstalling and Configuring AI SOC Solution
Set roles and permissions	RBAC Considerations for AI SOCRBAC Considerations for AI SOC
Build connectors (AI Ingestion widget, Turbine Schema)	AI SOC IngestionAI SOC Ingestion
Run your first investigation	Getting StartedGetting Started
Understand data flow and playbook handoffs	Architecture and Data FlowArchitecture and Data Flow
Map playbook flows, triggers, and troubleshooting	Playbook Flow ReferencePlaybook Flow Reference
Learn the applications	AI SOC ApplicationsAI SOC Applications
Author KB articles	Knowledge Base Articles (KB)Knowledge Base Articles (KB)
Do daily tasks	Operations and GuidanceOperations and Guidance
Build routing rule playbooks	Building Routing Rule PlaybooksBuilding Routing Rule Playbooks
Monitor operations	Dashboards and ReportsDashboards and Reports
Improve how you use AI SOC	Operational Best PracticesOperational Best Practices
See example investigations	Example ScenariosExample Scenarios
Connect your tools	Integration ExamplesIntegration Examples
Fix issues	TroubleshootingTroubleshooting

Role or Goal	Suggested Order
Installer / admin	Installing and Configuring AI SOC SolutionInstalling and Configuring AI SOC Solution → RBAC Considerations for AI SOCRBAC Considerations for AI SOC → Getting StartedGetting Started
Analyst	Getting StartedGetting Started → AI SOC ApplicationsAI SOC Applications → Operations and GuidanceOperations and Guidance
Architect / PS	Architecture and Data FlowArchitecture and Data Flow → Playbook Types and UsagePlaybook Types and Usage → Playbook Flow ReferencePlaybook Flow Reference
New alert source	Choose Your Ingestion Path → Configure Ingestion PlaybooksConfigure Ingestion Playbooks or AI SOC IngestionAI SOC Ingestion