--- title: AI SOC Solution slug: solutions/ai-soc-solution docTags: createdAt: 2026-02-17T06:44:55.233Z --- The **AI SOC Solution** is an end-to-end security operations package powered by **Hero AI**. Alerts and reported phishing email become **Case Management** records (prefix **CASE-**); playbooks enrich, correlate, route, and support analyst triage in one place. ## Choose Your Path | If You Want To... | Start Here | | ----------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------ | | Install and configure the solution | [Installing and Configuring AI SOC Solution](docId:_b7njxu5XnzYrjCnGQg5J) | | Enable agentic investigation after import | [Getting Started — Enable Agentic Investigation After Import](https://docs.swimlane.com/solutions/getting-started#enable-agentic-investigation-after-import) | | Run your first investigation | [Getting Started](docId\:p7QJQUayeKczHPxEpPWcp) | | Understand data flow (diagrams) | [Architecture and Data Flow](docId\:kWCIabPwqOzQcjd2eZtic) | | Look up playbook flows and triggers | [Playbook Flow Reference](docId\:ZLfIPKIHFJKNqGcHW7Sxb) | | Connect a new alert source | [Choose Your Ingestion Path](https://docs.swimlane.com/solutions/installing-and-configuring-ai-soc-solution#choose-your-ingestion-path) | | Do daily analyst work | [Operations and Guidance](docId\:DsdGtAQeg95DSeAF2Iat-) | | Learn applications and record layout | [AI SOC Applications](docId\:UOSUZRpSl6hFe9d6Br5az) | | Fix an issue | [Troubleshooting](docId\:cKnuXQV85k9lu0OCqV218) | ## Workflow at a Glance | Step | What Happens | Learn More | | ------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | 1. Ingest | Webhook, cron, or email playbooks receive alerts or phishing reports | [Choose Your Ingestion Path](https://docs.swimlane.com/solutions/installing-and-configuring-ai-soc-solution#choose-your-ingestion-path) | | 2. Normalize | **Ingest Alert/Email to CASE Record** creates or updates **CASE-** records | [Architecture and Data Flow](docId\:kWCIabPwqOzQcjd2eZtic) | | 3. Enrich | Threat intelligence and knowledge base articles attach to the record | [Threat Intelligence (TI)](docId\:e1QpWKFxzX978J09DL7Oz) | | 4. Evaluate | Correlation, rules engine, and Hero AI verdict when gates are complete | [Understanding Verdict Generation](docId\:bnyC263YSL2bmAJhBaIOb) | | 5. Investigate | Analysts claim records and investigate in **AI Alert Analysis** using one of three approaches: **AI assisted investigation** (Hero AI plan; analyst runs steps), **agentic investigation** (Analysis agent via **Re-investigate** in **AI Alert Analysis** when **Analysis Mode** is **Autonomous**, or a **Signal Routing Rule**), or **review after routing** (agentic investigation already completed—review plan, verdict, and component results) | [Getting Started](docId\:p7QJQUayeKczHPxEpPWcp), [Investigation Plan Workflow](docId\:BdE8P71Mmp2LByMuZuOOI), [Building Routing Rule Playbooks](docId\:vEiFYG4oYWkQ3DcMMwjXi) | | 6. Route / automate | **Signal Routing Rules** trigger **Rule-Execute** playbooks; repeat patterns use playbooks built from prior investigations | [Building Routing Rule Playbooks](docId\:vEiFYG4oYWkQ3DcMMwjXi), [Creating Automation](docId\:wJpjTO3fjnO0JiO1DYV3S) | | 7. Resolve | Status, classification, and closure per tenant playbooks and analyst action | [Case Management (CASE)](docId\:sDpESfT6Lsyz0zfrn_hok) | **Analyst entry point:** **Case Management** → **AI Alert Analysis** panel (**AI Analysis** widget). Hands-on steps: [Getting Started](docId\:p7QJQUayeKczHPxEpPWcp). ## What Is in the Package | Area | Included | Guide | | ------------------------ | -------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------- | | Triage and investigation | **Case Management**, Hero AI plans and verdicts; **AI assisted investigation** (manual plan) or **agentic investigation** (Analysis agent) | [AI SOC Applications](docId\:UOSUZRpSl6hFe9d6Br5az), [Getting Started](docId\:p7QJQUayeKczHPxEpPWcp) | | Enrichment and routing | **Threat Intelligence**, **Signal Routing Rules**, **Knowledge Base Articles** | [Configure Threat Intelligence Enrichment](docId:_wafAIm1sG-7z1UZmvr-P), [Knowledge Base Articles (KB)](docId\:NTgNxpVESzjGY_LlqoJmF) | | Ingestion builder | **AI Ingestion** application and workspace (alert sources) | [AI SOC Ingestion](docId:0p9Qwz3o-0J5DNkPJUGmq) | | Reporting | **SOC Reporting**, **ROI Calculator** workspaces | [Dashboards](docId\:AAYntc5RuMVE6M_Xru_0_) | | Automation | Prebuilt playbooks, assets, dashboards; **agentic investigation** via **AI SOC - Trigger Analysis Agent via Routing Rule** (routing rules created post-import) | [Playbook Types and Usage](docId\:Np4vvQLU6pnRWzSbEL_EO), [Building Routing Rule Playbooks](docId\:vEiFYG4oYWkQ3DcMMwjXi) | | Tenant connectivity | **AI SOC Tenant Configuration**, **Turbine Tenant Credentials** | [Configure Custom Assets](docId\:qDCKIJLolS_7DWZJgRBqK) | ## Key Capabilities | Capability | Summary | | ------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | **Ingestion** | Multi-source alerts (webhook, API, cron); phishing email processing; Turbine Schema normalization | | **Threat intelligence** | Multi-provider enrichment; primary provider per observable type; manual and automatic enrichment | | **Hero AI** | Investigation plans (generate, regenerate, progress detail), **AI assisted** and **agentic** investigation paths, verdicts (Malicious, Suspicious, Benign, Unknown), plans-to-playbooks, MITRE mapping, remediation guidance (manual execution) | | **Routing and playbooks** | Condition-based rules; **agentic investigation** via **AI SOC - Trigger Analysis Agent via Routing Rule**; repeatable **automated playbooks** for cost-efficient handling of recurring alert types; Marketplace components | | **Case management** | Unified **CASE-** lifecycle, evidence, escalation, metrics | | **Knowledge base** | Scoped articles (**Global**, **Signal Source**, **Signal Rule**, **Signal Name**) linked by **Matching Value** | | **Correlation** | Related signals and historical context on the case record | ## Next Steps | If You Want To... | Go To | | ---------------------------------------------------------------- | ------------------------------------------------------------------------- | | **Install and configure** (assets, Hero AI, ingestion playbooks) | [Installing and Configuring AI SOC Solution](docId:_b7njxu5XnzYrjCnGQg5J) | | **Set roles and permissions** | [RBAC Considerations for AI SOC](docId\:Jl6Dsw0QjBkPq_iOJDgLp) | | **Build connectors** (AI Ingestion widget, Turbine Schema) | [AI SOC Ingestion](docId:0p9Qwz3o-0J5DNkPJUGmq) | | **Run your first investigation** | [Getting Started](docId\:p7QJQUayeKczHPxEpPWcp) | | **Understand data flow and playbook handoffs** | [Architecture and Data Flow](docId\:kWCIabPwqOzQcjd2eZtic) | | **Map playbook flows, triggers, and troubleshooting** | [Playbook Flow Reference](docId\:ZLfIPKIHFJKNqGcHW7Sxb) | | **Learn the applications** | [AI SOC Applications](docId\:UOSUZRpSl6hFe9d6Br5az) | | **Author KB articles** | [Knowledge Base Articles (KB)](docId\:NTgNxpVESzjGY_LlqoJmF) | | **Do daily tasks** | [Operations and Guidance](docId\:DsdGtAQeg95DSeAF2Iat-) | | **Build routing rule playbooks** | [Building Routing Rule Playbooks](docId\:vEiFYG4oYWkQ3DcMMwjXi) | | **Monitor operations** | [Dashboards and Reports](docId\:deVHsmAt40H1MlpUcMEnr) | | **Improve how you use AI SOC** | [Operational Best Practices](docId\:wW_GfWujLJT7OpjDuU8vg) | | **See example investigations** | [Example Scenarios](docId\:mG9XUakOaXK0hy1tlf5Dm) | | **Connect your tools** | [Integration Examples](docId\:vm1j5-5rzQX4LC0HqoAIV) | | **Fix issues** | [Troubleshooting](docId\:cKnuXQV85k9lu0OCqV218) | ### Recommended Reader Journeys | Role or Goal | Suggested Order | | --------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | **Installer / admin** | [Installing and Configuring AI SOC Solution](docId:_b7njxu5XnzYrjCnGQg5J) → [RBAC Considerations for AI SOC](docId\:Jl6Dsw0QjBkPq_iOJDgLp) → [Getting Started](docId\:p7QJQUayeKczHPxEpPWcp) | | **Analyst** | [Getting Started](docId\:p7QJQUayeKczHPxEpPWcp) → [AI SOC Applications](docId\:UOSUZRpSl6hFe9d6Br5az) → [Operations and Guidance](docId\:DsdGtAQeg95DSeAF2Iat-) | | **Architect / PS** | [Architecture and Data Flow](docId\:kWCIabPwqOzQcjd2eZtic) → [Playbook Types and Usage](docId\:Np4vvQLU6pnRWzSbEL_EO) → [Playbook Flow Reference](docId\:ZLfIPKIHFJKNqGcHW7Sxb) | | **New alert source** | [Choose Your Ingestion Path](https://docs.swimlane.com/solutions/installing-and-configuring-ai-soc-solution#choose-your-ingestion-path) → [Configure Ingestion Playbooks](docId\:B1-f6uEPZ95dFN5nNl0lA) or [AI SOC Ingestion](docId:0p9Qwz3o-0J5DNkPJUGmq) | Use the links in the tables above for each step in a journey.