Building Routing Rule Playbooks

use this guide when you need an investigation playbook without opening a case management record first—for example, to prepare automation before alerts arrive, or to build a playbook in orchestration and link it on a signal routing rules record directly choose your investigation and automation path starting in turbine 26 2 0 , ai soc supports three complementary approaches use this table to choose how to investigate alerts and when to convert patterns into repeatable automation path when to use how routing is linked option 1 ai assisted investigation hero ai generates a plan; the analyst manually executes steps on the record after investigation, use create a playbook in automation to convert the pattern into an investigation playbook —see creating automation /creating automation md option 2 agentic investigation alerts that do not need full human investigation during the run—only quality control and audit afterward examples first seen alert types, overnight triage, or alert classes you trust the analysis agent to handle end to end create a signal routing rules record and associate ai soc trigger analysis agent via routing rule , or start agentic investigation from the record with re investigate in ai alert analysis (after setting analysis mode to autonomous on support )—see agentic investigation via routing rules /#agentic investigation via routing rules option 3 automated playbooks repeatable, cost efficient handling of recurring alert types you may investigate agentically the first time an alert type appears, then use classic automation for subsequent matches to save cost and improve predictability create the playbook under orchestration → playbooks (or convert from option 1 or option 2), then associate it on a signal routing rules record option 1 and option 2 both produce investigation patterns you can turn into option 3 playbooks customers can use turbine's playbook builder to convert an investigation into a playbook automatically ( create a playbook / recreate playbook on a case) or build and associate a playbook manually in orchestration for automation from a case management record, see creating automation /creating automation md for rule conditions, order, and testing, see signal routing rules (rule) docid\ bijf7m9etympud9 aozbl post import quick start for agentic investigation after you install the ai soc packages, complete this checklist before you expect routing rule agentic runs (for example, auto ai soc or overnight triage) verify packages ai soc solution and ai soc trigger analysis agent content are installed verify playbook in orchestration → playbooks , confirm ai soc trigger analysis agent via routing rule is present (disabled by default) configure pat set the pat token asset referenced by that playbook — see rbac considerations for ai soc docid\ jl6dsw0qjbkpq iojdglp enable playbook enable ai soc trigger analysis agent via routing rule when you are ready for production or test routing create routing rule add a signal routing rules record with if conditions that match the signals you want the analysis agent to handle for a catch all agentic rule, set rule order to a high value such as 99999 so more specific routing rules evaluate first optionally name the rule ai agentic investigation associate and wire (required) select ai soc trigger analysis agent via routing rule as associated playbook —required for unmatched or first seen catch all agentic routing—then apply rule to playbook so the rule execute trigger receives the rule uuid enable and test enable the rule and run run rule against pending signals on the rule support tab no default routing rule ships in the package if no rule exists after import, agentic investigation still works on individual records via re investigate when analysis mode is autonomous — see getting started docid\ p7qjquayekczhpxeppwcp terminology in ai soc, investigation playbooks are turbine playbooks that run when a signal routing rule matches and its conditions are met this includes playbooks you build in orchestration , playbooks created from a case ( create a playbook ), and the packaged ai soc trigger analysis agent via routing rule container avoid mixing terms like "routing playbook" or "rule execute playbook" in runbooks—use investigation playbook and describe how routing rules invoke it how routing rules invoke investigation playbooks when an enabled signal routing rule matches a case management record, the rules engine emits a rule execute flow event that includes the rule's rule uuid and a tracking id for the matched record the associated investigation playbook listens for that event, loads the record, runs investigation steps, and finishes with a verdict so the case is updated a single routing rule runs one investigation playbook use separate rules and playbooks for different patterns rule order matters—the platform evaluates rules from top to bottom agentic investigation via routing rules the ai soc trigger analysis agent solution package ( ssp ) includes ai soc trigger analysis agent via routing rule this playbook is a routing container it listens for rule execute events and calls the ai soc trigger analysis agent component the analysis agent (not the playbook) performs the investigation agentically—selecting tools, following knowledge base guidance, and writing plan, verdict, and component results to the record use agentic investigation via routing when certain alert types can be handled without analyst intervention during the run—you review and audit results afterward you want first seen or overnight triage before analysts arrive you prefer agentic handling for some alert classes and classic automated playbooks (option 3) for recurring matches to control cost and predictability item detail playbook (container) ai soc trigger analysis agent via routing rule — invokes the agent only; investigation only (not automated remediation); ships disabled until you enable it component (agent) ai soc trigger analysis agent — performs agentic investigation on the matched signal routing rules no routing rule records ship in the ssp create and enable signal routing rules after import, then associate this playbook setup administrator or orchestrator configures a pat token in an asset used by the playbook — see rbac considerations for ai soc /rbac%20considerations%20for%20ai%20soc md typical pattern place known alert type automated playbooks (option 3) above your agentic routing rule for a catch all agentic rule, set rule order to a high value such as 99999 so it stays at the bottom of evaluation order note see requirement — associated playbook below before creating the rule use ai soc trigger analysis agent via routing rule for unmatched or first seen signals after analysts review agentic results, use create a playbook from automation to convert repeatable patterns into classic automation so subsequent alerts run the playbook instead of invoking the agent again—and so recurring alerts avoid full agentic investigation and reduce ai/token cost requirement — associated playbook for unmatched or first seen catch all agentic routing, associated playbook (or selected playbook ) must be ai soc trigger analysis agent via routing rule a high rule order alone is not enough the platform’s auto rule order logic for create a triage rule excludes rules associated with this playbook when calculating the next order, so new specific rules stay before the catch all if your catch all uses a different playbook, new rules can receive an order above the catch all (for example 100000 after 99999 ) optionally name the catch all rule ai agentic investigation for clarity; the playbook association is what matters to associate ai soc trigger analysis agent via routing rule open application records → signal routing rules (or routing rule management → add new rule ) set if conditions for a catch all agentic rule, set rule order to a high value such as 99999 so more specific routing rules evaluate first in associated playbook , select ai soc trigger analysis agent via routing rule (required for the catch all; must use rule execute trigger) apply the rule to the playbook, enable the rule when ready, and test with run rule against pending signals on the support tab prerequisites for an investigation playbook before you associate a custom multi step investigation playbook on a signal routing rules record, configure the playbook as follows ai soc trigger analysis agent via routing rule is preconfigured in the package and does not require these steps prerequisite what to configure rule execute flow event trigger add a flow event trigger choose existing flow event (not create new) and select rule execute ( rule execute ) this sensor ships with the ai soc bundle after you select it, event data should expose rule uuid and tracking id if fields do not appear, save the playbook and reload the builder search records for the case add a search records (or equivalent) action that loads the case management record using the flow event tracking id (for example, tracking id equals the event's tracking id) you need the record in the flow before later steps run verdict component at the end add the ai soc verdict step (for example, ai soc case hero ai analysis or the verdict component from your package) as the last step so the alert receives an ai verdict and the case updates steps between search records and the verdict are optional $ed on the verdict in the verdict component evidence (or equivalent) section, set the expression to $ed so verdict generation uses outputs from earlier actions in the flow single flow keep all steps in one flow rule uuid on the trigger you do not add the rule uuid condition yourself when you first build the playbook after you associate the playbook on a routing rule and choose apply rule to playbook , the platform adds a trigger condition so rule uuid matches that rule open the playbook in orchestration , refresh, and confirm the condition appears (for example, rule uuid matches the rule's identifier) $actions in the ui the evidence field may look empty if you leave the verdict step and return later, even though $actions is saved check the playbook yaml if you need to confirm the value is present create a playbook manually in orchestration go to orchestration → playbooks and create a new playbook add a flow event trigger in the trigger configuration, select existing flow event and choose rule execute ( rule execute ) confirm event data includes rule uuid and tracking id save and reload the playbook if the fields are missing add search records (or your package's record lookup action) map tracking id from the flow event so the flow loads the matched case management record add any investigation or response components you need between lookup and verdict add the ai soc verdict component as the final step in the verdict step, open evidence (or the field your package uses for prior action output) and set the expression to $actions save and enable the playbook you can add hero ai or other builder assistance on the playbook page; the prerequisites above still apply associate the playbook with a routing rule you can create or edit a signal routing rules record without an open case open application records → signal routing rules , or use routing rule management → add new rule on the rule tab, set if conditions (for example, signal source , alert name , severity) set rule application to case management (or as required) configure rule order and enabled when ready wait for the page to finish loading the associated playbook (or selected playbook ) list is populated after load select your playbook only playbooks that use the rule execute flow event trigger appear a playbook without that trigger (for example, a blank test playbook) does not show in the list apply the rule to the playbook (for example, apply rule to playbook ) confirm the success message open the playbook in orchestration and refresh verify a rule uuid condition on the rule execute trigger matches this routing rule on the rule support tab, use run rule against pending signals to test review records matched when the rule matches a record, the engine emits rule execute with that rule's uuid; the playbook trigger condition and flow run for that case other ways to get a compatible playbook duplicate an existing investigation playbook in orchestration → playbooks , duplicate an investigation playbook already tied to a working rule or a package triage template edit investigation steps only; keep rule execute , search records , verdict, and $actions generate playbook, then cancel from the playbook builder (including after create a playbook on a case), start generate playbook and cancel when the template appears the draft includes sample timeline, verdict, and rule execute wiring edit, save, then associate on the routing rule if you did not use the case automation flow next steps topic guide create rules and investigation playbooks from a case creating automation /creating automation md playbook categories in ai soc playbook types and usage /playbook types and usage md flow level triggers and handoffs playbook flow reference /playbook flow reference md routing rule fields and dashboard signal routing rules (rule) /ai soc applications/signal routing rules rule md playbook does not run or wrong behavior troubleshooting /troubleshooting md flow event triggers in turbine turbine user guide — flow event trigger