--- title: Building Routing Rule Playbooks slug: solutions/building-routing-rule-playbooks docTags: createdAt: 2026-05-21T05:57:46.668Z --- Use this guide when you need an **investigation playbook** **without** opening a **Case Management** record first—for example, to prepare automation before alerts arrive, or to build a playbook in **Orchestration** and link it on a **Signal Routing Rules** record directly. ## Choose Your Investigation and Automation Path Starting in **Turbine 26.2.0**, AI SOC supports three complementary approaches. Use this table to choose how to investigate alerts and when to convert patterns into repeatable automation. | **Path** | **When to use** | **How routing is linked** | | --------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | **Option 1: AI assisted investigation** | Hero AI generates a plan; the analyst manually executes steps on the record | After investigation, use **Create a Playbook** in **Automation** to convert the pattern into an **investigation playbook**—see [Creating Automation](<./Creating Automation.md>) | | **Option 2: Agentic investigation** | Alerts that do not need full human investigation during the run—only quality control and audit afterward. Examples: first-seen alert types, overnight triage, or alert classes you trust the Analysis agent to handle end to end | Create a **Signal Routing Rules** record and associate **AI SOC - Trigger Analysis Agent via Routing Rule**, or start agentic investigation from the record with **Re-investigate** in **AI Alert Analysis** (after setting **Analysis Mode** to **Autonomous** on **Support**)—see [Agentic investigation via routing rules](./#agentic-investigation-via-routing-rules) | | **Option 3: Automated playbooks** | Repeatable, cost-efficient handling of recurring alert types. You may investigate agentically the first time an alert type appears, then use classic automation for subsequent matches to save cost and improve predictability | Create the playbook under **Orchestration** → **Playbooks** (or convert from Option 1 or Option 2), then associate it on a **Signal Routing Rules** record | Option 1 and Option 2 both produce investigation patterns you can turn into Option 3 playbooks. Customers can use Turbine's playbook builder to convert an investigation into a playbook automatically (**Create a Playbook** / **Recreate Playbook** on a case) or build and associate a playbook manually in **Orchestration**. For automation from a **Case Management** record, see [Creating Automation](<./Creating Automation.md>). For rule conditions, order, and testing, see [Signal Routing Rules (RULE)](docId\:biJF7m9ETYmpud9-AOzbL). ## Post-Import Quick Start for Agentic Investigation After you install the AI SOC packages, complete this checklist before you expect routing-rule agentic runs (for example, Auto AI-SOC or overnight triage): 1. **Verify packages:** **AI SOC Solution** and **AI SOC Trigger Analysis Agent** content are installed. 2. **Verify playbook:** In **Orchestration** → **Playbooks**, confirm **AI SOC - Trigger Analysis Agent via Routing Rule** is present (disabled by default). 3. **Configure PAT:** Set the **PAT token** asset referenced by that playbook — see [RBAC Considerations for AI SOC](docId\:Jl6Dsw0QjBkPq_iOJDgLp). 4. **Enable playbook:** Enable **AI SOC - Trigger Analysis Agent via Routing Rule** when you are ready for production or test routing. 5. **Create routing rule:** Add a **Signal Routing Rules** record with **IF** conditions that match the signals you want the Analysis agent to handle. For a catch-all agentic rule, set **Rule Order** to a high value such as **99999** so more specific routing rules evaluate first. Optionally name the rule **AI Agentic Investigation**. 6. **Associate and wire (required):** Select **AI SOC - Trigger Analysis Agent via Routing Rule** as **Associated Playbook**—required for unmatched or first-seen catch-all agentic routing—then **Apply rule to playbook** so the **Rule-Execute** trigger receives the rule **UUID**. 7. **Enable and test:** Enable the rule and run **Run Rule Against Pending Signals** on the rule **Support** tab. :::hint{type="info"} **No default routing rule ships in the package.** If no rule exists after import, agentic investigation still works on individual records via **Re-investigate** when **Analysis Mode** is **Autonomous** — see [Getting Started](docId\:p7QJQUayeKczHPxEpPWcp). ::: :::hint{type="info"} **Terminology:** In AI SOC, **investigation playbooks** are Turbine playbooks that run when a **Signal Routing Rule** matches and its conditions are met. This includes playbooks you build in **Orchestration**, playbooks created from a case (**Create a Playbook**), and the packaged **AI SOC - Trigger Analysis Agent via Routing Rule** container. Avoid mixing terms like "routing playbook" or "Rule-Execute playbook" in runbooks—use **investigation playbook** and describe how **routing rules** invoke it. ::: ## How Routing Rules Invoke Investigation Playbooks When an enabled **Signal Routing Rule** matches a **Case Management** record, the rules engine emits a **Rule-Execute** flow event that includes the rule's **Rule-UUID** and a **tracking ID** for the matched record. The associated **investigation playbook** listens for that event, loads the record, runs investigation steps, and finishes with a verdict so the case is updated. A single routing rule runs **one** investigation playbook. Use separate rules and playbooks for different patterns. **Rule order** matters—the platform evaluates rules from top to bottom. ## Agentic Investigation via Routing Rules The **AI SOC Trigger Analysis Agent** solution package (**SSP**) includes **AI SOC - Trigger Analysis Agent via Routing Rule**. This playbook is a **routing container**: it listens for **Rule-Execute** events and calls the **AI SOC - Trigger Analysis Agent** component. The **Analysis agent** (not the playbook) performs the investigation agentically—selecting tools, following knowledge base guidance, and writing plan, verdict, and component results to the record. Use agentic investigation via routing when: - Certain alert types can be handled without analyst intervention during the run—you review and audit results afterward - You want first-seen or overnight triage before analysts arrive - You prefer agentic handling for some alert classes and classic **automated playbooks** (Option 3) for recurring matches to control cost and predictability | **Item** | **Detail** | | ------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | | **Playbook (container)** | **AI SOC - Trigger Analysis Agent via Routing Rule** — invokes the agent only; investigation only (not automated remediation); ships **disabled** until you enable it | | **Component (agent)** | **AI SOC - Trigger Analysis Agent** — performs agentic investigation on the matched signal | | **Routing rules** | **No routing rule records ship in the SSP.** Create and enable **Signal Routing Rules** after import, then associate this playbook | | **Setup** | Administrator or orchestrator configures a **PAT token** in an asset used by the playbook — see [RBAC Considerations for AI SOC](../RBAC%20Considerations%20for%20AI%20SOC.md) | **Typical pattern:** Place known alert-type **automated playbooks** (Option 3) **above** your agentic routing rule. For a catch-all agentic rule, set **Rule Order** to a high value such as **99999** so it stays at the bottom of evaluation order. :::hint{type="info"} **Note:** See **Requirement — Associated Playbook** below **before** creating the rule. ::: Use **AI SOC - Trigger Analysis Agent via Routing Rule** for unmatched or first-seen signals. After analysts review agentic results, use **Create a Playbook** from **Automation** to convert repeatable patterns into classic automation so subsequent alerts run the playbook instead of invoking the agent again—and so recurring alerts avoid full agentic investigation and reduce AI/token cost. :::hint{type="warning"} **Requirement — Associated Playbook:** For unmatched or first-seen catch-all agentic routing, **Associated Playbook** (or **Selected Playbook**) **must** be **AI SOC - Trigger Analysis Agent via Routing Rule**. A high **Rule Order** alone is not enough. The platform’s auto **Rule Order** logic for **Create a Triage Rule** excludes rules associated with this playbook when calculating the next order, so new specific rules stay **before** the catch-all. If your catch-all uses a different playbook, new rules can receive an order **above** the catch-all (for example **100000** after **99999**). Optionally name the catch-all rule **AI Agentic Investigation** for clarity; the playbook association is what matters. ::: To associate **AI SOC - Trigger Analysis Agent via Routing Rule**: 1. Open **Application Records** → **Signal Routing Rules** (or **Routing Rule Management** → **Add New Rule**). 2. Set **IF** conditions. For a catch-all agentic rule, set **Rule Order** to a high value such as **99999** so more specific routing rules evaluate first. 3. In **Associated Playbook**, select **AI SOC - Trigger Analysis Agent via Routing Rule** (required for the catch-all; must use **Rule-Execute** trigger). 4. Apply the rule to the playbook, enable the rule when ready, and test with **Run Rule Against Pending Signals** on the **Support** tab. ## Prerequisites for an Investigation Playbook Before you associate a custom multi-step **investigation playbook** on a **Signal Routing Rules** record, configure the playbook as follows. **AI SOC - Trigger Analysis Agent via Routing Rule** is preconfigured in the package and does not require these steps. | **Prerequisite** | **What to configure** | | ----------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | **Rule-Execute flow event trigger** | Add a **Flow Event** trigger. Choose **Existing flow event** (not create new) and select **rule execute** (**Rule-Execute**). This sensor ships with the AI SOC bundle. After you select it, event data should expose **rule UUID** and **tracking ID**. If fields do not appear, save the playbook and reload the builder. | | **Search Records for the case** | Add a **Search Records** (or equivalent) action that loads the **Case Management** record using the flow event **tracking ID** (for example, tracking ID equals the event's tracking ID). You need the record in the flow before later steps run. | | **Verdict component at the end** | Add the AI SOC verdict step (for example, **AI SOC - CASE Hero AI Analysis** or the verdict component from your package) as the **last** step so the alert receives an AI verdict and the case updates. Steps between Search Records and the verdict are optional. | | `$ed`** on the verdict** | In the verdict component **Evidence** (or equivalent) section, set the expression to `$ed` so verdict generation uses outputs from earlier actions in the flow. | | **Single flow** | Keep all steps in **one flow**. | :::hint{type="info"} **Rule-UUID on the trigger:** You do not add the **Rule-UUID** condition yourself when you first build the playbook. After you associate the playbook on a routing rule and choose **Apply rule to playbook**, the platform adds a trigger condition so **rule UUID** matches that rule. Open the playbook in **Orchestration**, refresh, and confirm the condition appears (for example, **rule UUID** matches the rule's identifier). ::: :::hint{type="info"} `$actions`** in the UI:** The **Evidence** field may look empty if you leave the verdict step and return later, even though `$actions` is saved. Check the playbook YAML if you need to confirm the value is present. ::: ## Create a Playbook Manually in Orchestration 1. Go to **Orchestration** → **Playbooks** and create a new playbook. 2. Add a **Flow Event** trigger. 3. In the trigger configuration, select **Existing flow event** and choose **rule execute** (**Rule-Execute**). 4. Confirm event data includes **rule UUID** and **tracking ID**. Save and reload the playbook if the fields are missing. 5. Add **Search Records** (or your package's record lookup action). Map **tracking ID** from the flow event so the flow loads the matched **Case Management** record. 6. Add any investigation or response components you need between lookup and verdict. 7. Add the AI SOC **verdict** component as the final step. 8. In the verdict step, open **Evidence** (or the field your package uses for prior action output) and set the expression to `$actions`. 9. Save and enable the playbook. You can add Hero AI or other builder assistance on the playbook page; the prerequisites above still apply. ## Associate the Playbook With a Routing Rule You can create or edit a **Signal Routing Rules** record without an open case. 1. Open **Application Records** → **Signal Routing Rules**, or use **Routing Rule Management** → **Add New Rule**. 2. On the **Rule** tab, set **IF** conditions (for example, **Signal Source**, **Alert Name**, severity). 3. Set **Rule Application** to **Case Management** (or as required). Configure **Rule Order** and **Enabled** when ready. 4. Wait for the page to finish loading. The **Associated Playbook** (or **Selected Playbook**) list is populated after load. 5. Select your playbook. Only playbooks that use the **Rule-Execute** flow event trigger appear. A playbook without that trigger (for example, a blank test playbook) does not show in the list. 6. Apply the rule to the playbook (for example, **Apply rule to playbook**). Confirm the success message. 7. Open the playbook in **Orchestration** and refresh. Verify a **rule UUID** condition on the **Rule-Execute** trigger matches this routing rule. 8. On the rule **Support** tab, use **Run Rule Against Pending Signals** to test. Review **Records Matched**. When the rule matches a record, the engine emits **Rule-Execute** with that rule's UUID; the playbook trigger condition and flow run for that case. ## Other Ways to Get a Compatible Playbook **Duplicate an existing investigation playbook:** In **Orchestration** → **Playbooks**, duplicate an investigation playbook already tied to a working rule or a package triage template. Edit investigation steps only; keep **Rule-Execute**, **Search Records**, verdict, and `$actions`. **Generate Playbook, then cancel:** From the playbook builder (including after **Create a Playbook** on a case), start **Generate Playbook** and cancel when the template appears. The draft includes sample timeline, verdict, and **Rule-Execute** wiring. Edit, save, then associate on the routing rule if you did not use the case automation flow. ## Next Steps | **Topic** | **Guide** | | ---------------------------------------------------- | -------------------------------------------------------------------------------------- | | Create rules and investigation playbooks from a case | [Creating Automation](<./Creating Automation.md>) | | Playbook categories in AI SOC | [Playbook Types and Usage](<./Playbook Types and Usage.md>) | | Flow-level triggers and handoffs | [Playbook Flow Reference](<./Playbook Flow Reference.md>) | | Routing rule fields and dashboard | [Signal Routing Rules (RULE)](<../AI SOC Applications/Signal Routing Rules _RULE_.md>) | | Playbook does not run or wrong behavior | [Troubleshooting](../Troubleshooting.md) | | Flow event triggers in Turbine | Turbine User Guide — **Flow Event Trigger** |