Building Routing Rule Playbooks

Use this guide when you need an investigation playbook without opening a Case Management record first—for example, to prepare automation before alerts arrive, or to build a playbook in Orchestration and link it on a Signal Routing Rules record directly.

Choose Your Investigation and Automation Path

Starting in Turbine 26.2.0, AI SOC supports three complementary approaches. Use this table to choose how to investigate alerts and when to convert patterns into repeatable automation.

Path	When to use	How routing is linked
Option 1: AI assisted investigation	Hero AI generates a plan; the analyst manually executes steps on the record	After investigation, use Create a Playbook in Automation to convert the pattern into an investigation playbook—see Creating Automation
Option 2: Agentic investigation	Alerts that do not need full human investigation during the run—only quality control and audit afterward. Examples: first-seen alert types, overnight triage, or alert classes you trust the Analysis agent to handle end to end	Create a Signal Routing Rules record and associate AI SOC - Trigger Analysis Agent via Routing Rule, or start agentic investigation from the record with Re-investigate in AI Alert Analysis (after setting Analysis Mode to Autonomous on Support)—see Agentic investigation via routing rules
Option 3: Automated playbooks	Repeatable, cost-efficient handling of recurring alert types. You may investigate agentically the first time an alert type appears, then use classic automation for subsequent matches to save cost and improve predictability	Create the playbook under Orchestration → Playbooks (or convert from Option 1 or Option 2), then associate it on a Signal Routing Rules record

Option 1 and Option 2 both produce investigation patterns you can turn into Option 3 playbooks. Customers can use Turbine's playbook builder to convert an investigation into a playbook automatically (Create a Playbook / Recreate Playbook on a case) or build and associate a playbook manually in Orchestration.

For automation from a Case Management record, see Creating Automation. For rule conditions, order, and testing, see Signal Routing Rules (RULE)Signal Routing Rules (RULE).

Post-Import Quick Start for Agentic Investigation

After you install the AI SOC packages, complete this checklist before you expect routing-rule agentic runs (for example, Auto AI-SOC or overnight triage):

Verify packages: AI SOC Solution and AI SOC Trigger Analysis Agent content are installed.

Verify playbook: In Orchestration → Playbooks, confirm AI SOC - Trigger Analysis Agent via Routing Rule is present (disabled by default).

Configure PAT: Set the PAT token asset referenced by that playbook — see RBAC Considerations for AI SOCRBAC Considerations for AI SOC.

Enable playbook: Enable AI SOC - Trigger Analysis Agent via Routing Rule when you are ready for production or test routing.

Create routing rule: Add a Signal Routing Rules record with IF conditions that match the signals you want the Analysis agent to handle. For a catch-all agentic rule, set Rule Order to a high value such as 99999 so more specific routing rules evaluate first. Optionally name the rule AI Agentic Investigation.

Associate and wire (required): Select AI SOC - Trigger Analysis Agent via Routing Rule as Associated Playbook—required for unmatched or first-seen catch-all agentic routing—then Apply rule to playbook so the Rule-Execute trigger receives the rule UUID.

Enable and test: Enable the rule and run Run Rule Against Pending Signals on the rule Support tab.

No default routing rule ships in the package. If no rule exists after import, agentic investigation still works on individual records via Re-investigate when Analysis Mode is Autonomous — see Getting StartedGetting Started — Enable Agentic Investigation After Import.

Terminology: In AI SOC, investigation playbooks are Turbine playbooks that run when a Signal Routing Rule matches and its conditions are met. This includes playbooks you build in Orchestration, playbooks created from a case (Create a Playbook), and the packaged AI SOC - Trigger Analysis Agent via Routing Rule container. Avoid mixing terms like "routing playbook" or "Rule-Execute playbook" in runbooks—use investigation playbook and describe how routing rules invoke it.

How Routing Rules Invoke Investigation Playbooks

When an enabled Signal Routing Rule matches a Case Management record, the rules engine emits a Rule-Execute flow event that includes the rule's Rule-UUID and a tracking ID for the matched record. The associated investigation playbook listens for that event, loads the record, runs investigation steps, and finishes with a verdict so the case is updated.

A single routing rule runs one investigation playbook. Use separate rules and playbooks for different patterns. Rule order matters—the platform evaluates rules from top to bottom.

Agentic Investigation via Routing Rules

The AI SOC Trigger Analysis Agent solution package (SSP) includes AI SOC - Trigger Analysis Agent via Routing Rule. This playbook is a routing container: it listens for Rule-Execute events and calls the AI SOC - Trigger Analysis Agent component. The Analysis agent (not the playbook) performs the investigation agentically—selecting tools, following knowledge base guidance, and writing plan, verdict, and component results to the record.

Use agentic investigation via routing when:

Certain alert types can be handled without analyst intervention during the run—you review and audit results afterward

You want first-seen or overnight triage before analysts arrive

You prefer agentic handling for some alert classes and classic automated playbooks (Option 3) for recurring matches to control cost and predictability

Item	Detail
Playbook (container)	AI SOC - Trigger Analysis Agent via Routing Rule — invokes the agent only; investigation only (not automated remediation); ships disabled until you enable it
Component (agent)	AI SOC - Trigger Analysis Agent — performs agentic investigation on the matched signal
Routing rules	No routing rule records ship in the SSP. Create and enable Signal Routing Rules after import, then associate this playbook
Setup	Administrator or orchestrator configures a PAT token in an asset used by the playbook — see RBAC Considerations for AI SOC

Typical pattern: Place known alert-type automated playbooks (Option 3) above your agentic routing rule. For a catch-all agentic rule, set Rule Order to a high value such as 99999 so it stays at the bottom of evaluation order.

Note: See Requirement — Associated Playbook below before creating the rule.

Use AI SOC - Trigger Analysis Agent via Routing Rule for unmatched or first-seen signals. After analysts review agentic results, use Create a Playbook from Automation to convert repeatable patterns into classic automation so subsequent alerts run the playbook instead of invoking the agent again—and so recurring alerts avoid full agentic investigation and reduce AI/token cost.

Requirement — Associated Playbook: For unmatched or first-seen catch-all agentic routing, Associated Playbook (or Selected Playbook) must be AI SOC - Trigger Analysis Agent via Routing Rule. A high Rule Order alone is not enough. The platform’s auto Rule Order logic for Create a Triage Rule excludes rules associated with this playbook when calculating the next order, so new specific rules stay before the catch-all. If your catch-all uses a different playbook, new rules can receive an order above the catch-all (for example 100000 after 99999). Optionally name the catch-all rule AI Agentic Investigation for clarity; the playbook association is what matters.

To associate AI SOC - Trigger Analysis Agent via Routing Rule:

Open Application Records → Signal Routing Rules (or Routing Rule Management → Add New Rule).

Set IF conditions. For a catch-all agentic rule, set Rule Order to a high value such as 99999 so more specific routing rules evaluate first.

In Associated Playbook, select AI SOC - Trigger Analysis Agent via Routing Rule (required for the catch-all; must use Rule-Execute trigger).

Apply the rule to the playbook, enable the rule when ready, and test with Run Rule Against Pending Signals on the Support tab.

Prerequisites for an Investigation Playbook

Before you associate a custom multi-step investigation playbook on a Signal Routing Rules record, configure the playbook as follows. AI SOC - Trigger Analysis Agent via Routing Rule is preconfigured in the package and does not require these steps.

Prerequisite	What to configure
Rule-Execute flow event trigger	Add a Flow Event trigger. Choose Existing flow event (not create new) and select rule execute (Rule-Execute). This sensor ships with the AI SOC bundle. After you select it, event data should expose rule UUID and tracking ID. If fields do not appear, save the playbook and reload the builder.
Search Records for the case	Add a Search Records (or equivalent) action that loads the Case Management record using the flow event tracking ID (for example, tracking ID equals the event's tracking ID). You need the record in the flow before later steps run.
Verdict component at the end	Add the AI SOC verdict step (for example, AI SOC - CASE Hero AI Analysis or the verdict component from your package) as the last step so the alert receives an AI verdict and the case updates. Steps between Search Records and the verdict are optional.
$ed on the verdict	In the verdict component Evidence (or equivalent) section, set the expression to $ed so verdict generation uses outputs from earlier actions in the flow.
Single flow	Keep all steps in one flow.

Rule-UUID on the trigger: You do not add the Rule-UUID condition yourself when you first build the playbook. After you associate the playbook on a routing rule and choose Apply rule to playbook, the platform adds a trigger condition so rule UUID matches that rule. Open the playbook in Orchestration, refresh, and confirm the condition appears (for example, rule UUID matches the rule's identifier).

$actions in the UI: The Evidence field may look empty if you leave the verdict step and return later, even though $actions is saved. Check the playbook YAML if you need to confirm the value is present.

Create a Playbook Manually in Orchestration

Go to Orchestration → Playbooks and create a new playbook.

Add a Flow Event trigger.

In the trigger configuration, select Existing flow event and choose rule execute (Rule-Execute).

Confirm event data includes rule UUID and tracking ID. Save and reload the playbook if the fields are missing.

Add Search Records (or your package's record lookup action). Map tracking ID from the flow event so the flow loads the matched Case Management record.

Add any investigation or response components you need between lookup and verdict.

Add the AI SOC verdict component as the final step.

In the verdict step, open Evidence (or the field your package uses for prior action output) and set the expression to $actions.

Save and enable the playbook.

You can add Hero AI or other builder assistance on the playbook page; the prerequisites above still apply.

Associate the Playbook With a Routing Rule

You can create or edit a Signal Routing Rules record without an open case.

Open Application Records → Signal Routing Rules, or use Routing Rule Management → Add New Rule.

On the Rule tab, set IF conditions (for example, Signal Source, Alert Name, severity).

Set Rule Application to Case Management (or as required). Configure Rule Order and Enabled when ready.

Wait for the page to finish loading. The Associated Playbook (or Selected Playbook) list is populated after load.

Select your playbook. Only playbooks that use the Rule-Execute flow event trigger appear. A playbook without that trigger (for example, a blank test playbook) does not show in the list.

Apply the rule to the playbook (for example, Apply rule to playbook). Confirm the success message.

Open the playbook in Orchestration and refresh. Verify a rule UUID condition on the Rule-Execute trigger matches this routing rule.

On the rule Support tab, use Run Rule Against Pending Signals to test. Review Records Matched.

When the rule matches a record, the engine emits Rule-Execute with that rule's UUID; the playbook trigger condition and flow run for that case.

Other Ways to Get a Compatible Playbook

Duplicate an existing investigation playbook: In Orchestration → Playbooks, duplicate an investigation playbook already tied to a working rule or a package triage template. Edit investigation steps only; keep Rule-Execute, Search Records, verdict, and $actions.

Generate Playbook, then cancel: From the playbook builder (including after Create a Playbook on a case), start Generate Playbook and cancel when the template appears. The draft includes sample timeline, verdict, and Rule-Execute wiring. Edit, save, then associate on the routing rule if you did not use the case automation flow.

Next Steps

Topic	Guide
Create rules and investigation playbooks from a case	Creating Automation
Playbook categories in AI SOC	Playbook Types and Usage
Flow-level triggers and handoffs	Playbook Flow Reference
Routing rule fields and dashboard	Signal Routing Rules (RULE)
Playbook does not run or wrong behavior	Troubleshooting
Flow event triggers in Turbine	Turbine User Guide — Flow Event Trigger