---
title: Architecture and Data Flow
slug: solutions/architecture-and-data-flow
docTags: 
createdAt: 2026-03-27T06:05:32.448Z
---

This topic summarizes how data moves through the AI SOC solution: ingestion, normalization, enrichment, Hero AI, routing, and case handling. Diagrams are **conceptual**; playbook names, component counts, and **automatic** escalation or closure depend on your installed package and configuration.

For procedures and UI steps, use **[AI SOC Solution](docId\:DDizyEIQevgzG8Ay0FCc5)**, **[Getting Started](docId\:p7QJQUayeKczHPxEpPWcp)**, and **[AI SOC Ingestion](docId:0p9Qwz3o-0J5DNkPJUGmq)**. For playbook categories and when to use each playbook type, see **[Playbook Types and Usage](docId\:Np4vvQLU6pnRWzSbEL_EO)**. For a tabular map of playbook flows, triggers, and handoffs, see **[Playbook Flow Reference](docId\:ZLfIPKIHFJKNqGcHW7Sxb)** (includes a **Playbook Handoffs at a Glance** diagram).

## End-to-End Workflow

High-level path from alert sources through triage to closure. Primary triage and investigation use **Case Management** (tracking prefix **CASE-**).

![](https://api.archbee.com/api/optimize/n8uUzk0MM4uC57-zlHNtY/xnS7VdCajjRTr-QxbEwCC-20260402-141741.svg)

### Ingestion Channels and CASE Entry

AI SOC uses two internal event channels to separate alert-shaped and email-shaped traffic before both converge on **Case Management**:

- **Ingest\_Alert:** Alert-shaped payloads from webhook and bulk-alert cron Flows.
- **Ingest\_Email:** Email-shaped payloads from phishing cron and test email Flows.

Template and production Flows emit onto these channels (for example **Ingest Webhook Alert**, **Ingest Bulk Alerts**, **AI SOC – Phishing Ingestion (Cron) – Template**, and **AI SOC – Test Email Ingestion (Webhook)**). The entry Flows **Ingest Alert to CASE Record (Event)** and **Ingest Email to CASE Record (Event)** normalize payloads and create or update CASE records.

## Alert Ingestion Pipeline

Typical path for SIEM and similar alerts: ingest, map to a **Turbine Schema** alert, enrich, correlate, then **Case Management**.

![](https://api.archbee.com/api/optimize/n8uUzk0MM4uC57-zlHNtY/JF_PkjQJK4yRMO19lRTQH-20260402-141741.svg)

The **Ingest Webhook Alert** and **Ingest Bulk Alerts** Flows both publish to the **Ingest\_Alert** channel. **Alert Schema Store (AWSS)** caches example payloads and Turbine Schema field mappings so repeat vendor formats map consistently. The downstream Flow **Ingest Alert to CASE Record (Event)** reads from Ingest\_Alert and materializes or updates work in **Case Management**.

## Phishing Ingestion Pipeline

Reported phishing email path through parsing, a **Turbine Schema** email object, enrichment, and **Case Management**.

![](https://api.archbee.com/api/optimize/n8uUzk0MM4uC57-zlHNtY/4GJoRA6RfGYeKrkE6MBOE-20260402-141741.svg)

For phishing-style traffic, a scheduled template Playbook wraps a Flow that searches unread mailbox items for Turbine Schema email ingestion, retrieves email objects, and emits each one onto **Ingest\_Email** using **Emit TEDS Email** actions. A separate test webhook Playbook forwards lab messages to the same channel. The **Ingest Email to CASE Record (Event)** Flow consumes Ingest\_Email events and creates or updates phishing CASE records.

## Threat Intelligence Enrichment

Multi-provider enrichment, merged scores, **Turbine Risk Score**, and verdict fed back to the case under investigation.

![](https://api.archbee.com/api/optimize/n8uUzk0MM4uC57-zlHNtY/PcvknnrcVay4zVJauVz5K-20260402-141741.svg)

## Hero AI Analysis

Hero AI consumes case context (observables, threat intelligence, knowledge base) to produce summaries, verdicts, investigation plans, and optional remediation guidance on **Case Management** records.

![](https://api.archbee.com/api/optimize/n8uUzk0MM4uC57-zlHNtY/p7SfWAV6CUjV5eX0n1Nj9-20260402-141741.svg)

## AI Ingestion (Connectors and Schema Mapping)

The **AI Ingestion** application and custom widget support building vendor connectors from API specifications and mapping raw alert data to **Turbine Schema** for downstream playbooks.

![](https://api.archbee.com/api/optimize/n8uUzk0MM4uC57-zlHNtY/niVcuUCFG2O7w_QrWYe5m-20260402-141741.svg)

For step-by-step usage, see **[AI SOC Ingestion](docId:0p9Qwz3o-0J5DNkPJUGmq)**.

## Signal Routing Rules

**Routing Rule** records express conditions that map **Case Management** workload to playbooks for enrichment, correlation, and automated response. When a rule matches, the rules engine emits **Rule-Execute** with **rule UUID** and **tracking ID**; the associated playbook loads the case, runs optional steps, and ends with a verdict. See **[Building Routing Rule Playbooks](docId\:vEiFYG4oYWkQ3DcMMwjXi)**.

![](https://api.archbee.com/api/optimize/n8uUzk0MM4uC57-zlHNtY/m36P3iY8CEwqhewtjZiZq-20260402-141741.svg)

## Signal Status Lifecycle

**Case Management** records move through statuses such as **Processing**, **New**, **In Progress**, and **Closed**, with **Escalated** and other outcomes driven by your pending resolution flows and tenant configuration.

![](https://api.archbee.com/api/optimize/n8uUzk0MM4uC57-zlHNtY/f8-JcIj6uxTV57mmIX4in-20260402-141741.svg)