---
title: Configure AI SOC for MSSP
slug: solutions/configure-ai-soc-for-mssp
docTags: 
createdAt: 2026-05-28T10:13:23.255Z
---

Use this guide to configure client and central tenants after you install the AI SOC for MSSP solution layers. For install order and first validation, see [Getting Started for MSSP](docId\:ivvy6GXAjWc34xVMnNqC-).

## Choose Your Path

| **If you are configuring**                | **Go to**                                                                               |
| ----------------------------------------- | --------------------------------------------------------------------------------------- |
| Core client tenant PAT asset              | [Configure the Client Tenant](./#configure-the-client-tenant)                           |
| Client TIA applet for central TI sync     | [Include TIA Central Sync Fields](./#include-tia-central-sync-fields)                   |
| Disable Core TIA enrichment on the client | [Disable Enrich TIA Record in AI SOC Main](./#disable-enrich-tia-record-in-ai-soc-main) |
| Central ingestion webhook                 | [Configure the Central Tenant](./#configure-the-central-tenant)                         |
| MSSP sync assets on a client tenant       | [Configure MSSP Client Sync Assets](./#configure-mssp-client-sync-assets)               |

## Credential and Asset Overview

| **Asset or credential**               | **Tenant** | **Purpose**                                                                                                                                  |
| ------------------------------------- | ---------- | -------------------------------------------------------------------------------------------------------------------------------------------- |
| **AI SOC Tenant Configuration**       | Client     | PAT-based Swimlane API access for Hero AI flows (from **AI SOC Core Solution**). Field: **Private\_Token**.                                  |
| **AI SOC MSSP Client Configuration**  | Client     | **Client\_Name**, **Central\_Webhook\_URL**, **Central\_Tenant\_ID**, and **Central\_TIAC\_App\_ID** (from **AI SOC MSSP Client Extension**) |
| **AI SOC MSSP Central Sync**          | Client     | Webhook basic auth for case and reporting sync, and **PrivateToken** for central TIAC API calls (from **AI SOC MSSP Client Extension**)      |
| **Ingest Record from Client** webhook | Central    | Receives Case Management records and SOC reporting aggregates from client tenants. Required for case and reporting sync.                     |

:::hint{type="info"}
**AI SOC Tenant Configuration** comes from **AI SOC Core Solution**. MSSP sync assets come from **AI SOC MSSP Client Extension**. Open each by its title under **Orchestration** → **Assets**.
:::

:::hint{type="info"}
**PrivateToken** on **AI SOC MSSP Central Sync** is an admin personal access token authorized for the **central** tenant. It is used to create and update full **Threat Intelligence Artifact Cache** records over the API. It is not used to post case or report payloads; those use the webhook and **Authorization** username and password. It is also not the same value as **Private\_Token** on the client **AI SOC Tenant Configuration** asset.
:::

## Configure the Client Tenant

Complete these steps in each **client tenant** after **AI SOC Core Solution** and **AI SOC MSSP Client Extension** are installed.

### AI SOC Tenant Configuration

1. Open **AI SOC Tenant Configuration** under **Orchestration** → **Assets**.
2. Configure:
   - **Base\_URL:** Client Swimlane host
   - **Account\_Id:** Swimlane account identifier
   - **Tenant\_Id:** Client tenant identifier
   - **Private\_Token:** Valid Swimlane PAT that belongs to an Orchestrator or Administrator in the **client** tenant
3. Save and activate the asset when required.

For additional core asset detail, see [Configure Custom Assets](docId\:qDCKIJLolS_7DWZJgRBqK).

### Confirm client MSSP reporting

1. Confirm the **AI SOC MSSP Reporting** application and **AI SOC MSSP Reporting Workspace** are installed with **AI SOC MSSP Client Extension**.
2. Confirm **AI SOC MSSP - Reporting** and **SOC Reporting Sync** playbooks are present. Reporting sync uses the same central webhook as case sync; it is required for **Central SOC Reporting**.
3. Open the reporting workspace once to verify default dashboards load for your RBAC role.

### Include TIA Central Sync Fields

The **AI SOC MSSP Client Extension** includes the **TIA Central Sync Fields** applet. Add it to the client **Threat Intelligence** application so central TIAC create and update can write the required metadata fields. If this applet is missing, **AI SOC MSSP - Central Sync** can fail on **Update\_TIA\_Record** with key errors.

1. In the **client tenant**, open Application Builder for the **Threat Intelligence** application.
2. Select the **Support** layout tab.
3. From **Applet Display**, add **TIA Central Sync Fields** to the **Threat Intelligence Metadata** section.
4. Save the application.

Repeat this step in every client tenant after you install **AI SOC MSSP Client Extension**.

### Disable Enrich TIA Record in AI SOC Main

In each **client tenant**, disable the **Enrich TIA Record** (Create) flow in the Core playbook **AI SOC Main**. If this flow stays enabled, the client tenant enriches TIA observables even when a matching record already exists in central **Threat Intelligence Artifact Cache**. That duplicate enrichment defeats the purpose of the central TI cache.

1. In the **client tenant**, open **Orchestration** → **Playbooks**.
2. Open **AI SOC Main** (from **AI SOC Core Solution**).
3. Select the **Enrich TIA Record** action (Create).
4. Disable the flow.
5. Save the playbook.

Disable the **Enrich TIA Record** (Create) flow. Do not disable the **AI SOC Main** playbook. The **AI SOC MSSP Client Extension** checks central **Threat Intelligence Artifact Cache** first. Client enrichment is reserved for cache miss, stale data, or **Requires Re-Enrichment**, not for this Core create flow.

Repeat this step in every client tenant after you install **AI SOC Core Solution** and **AI SOC MSSP Client Extension**.

## Configure the Central Tenant

Complete these steps in the **central tenant** after **AI SOC MSSP Central Solution** is installed.

### Central Ingestion Webhook

This webhook is required. Client **Case Record Monitoring** and **SOC Reporting Sync** both post to it.

1. Navigate to **Orchestration** → **Playbooks**.
2. Open **Catch Records from Client** (the playbook that contains the **Ingest Record from Client** webhook sensor).
3. Select the **Ingest Record from Client** sensor.
4. Under authentication, set **Username** and **Password** for incoming client sync requests. The package may ship with a default username until you change it; use credentials you will copy to each client **AI SOC MSSP Central Sync** asset.
5. Enable the sensor if it is disabled after install.
6. Copy the webhook URL from the sensor configuration.
7. Save the playbook.
8. Record the webhook URL, username, and password in your onboarding worksheet for additional client tenants.

:::hint{type="info"}
The central MSSP solution does not ship separate central configuration assets. After install, the only required central configuration is **Ingest Record from Client** webhook authentication. Playbooks, workspaces, and applications are present from the package; you do not configure them beyond enabling the webhook sensor and confirming they load.
:::

After install, these central objects are available without further configuration:

- Playbooks: **Catch Records from Client**, **Upsert Central Case Management Record**, **Upsert Central Report Record**, **Set Requires Re-Enrichment**
- Workspaces: **AI SOC MSSP Central**, **Central SOC Reporting Workspace**, **Usage Statistics Workspace**
- Applications: **Central Case Management**, **Threat Intelligence Artifact Cache**, **Central SOC Reporting**, **Usage Statistics**

## Configure MSSP Client Sync Assets

Complete these steps in each **client tenant** after the central ingestion webhook is configured.

1. Open **Assets** under **Orchestration**.
2. Configure **AI\_SOC\_MSSP\_Client\_Configuration** (**AI SOC MSSP Client Configuration**):

| **Field**                  | **What to enter**                                                                                                                   |
| -------------------------- | ----------------------------------------------------------------------------------------------------------------------------------- |
| **Client\_Name**           | Unique MSSP client or tenant display name. This value is stamped on central case and reporting records so you can filter by client. |
| **Central\_Webhook\_URL**  | URL of the central **Ingest Record from Client** webhook                                                                            |
| **Central\_Tenant\_ID**    | Central tenant identifier                                                                                                           |
| **Central\_TIAC\_App\_ID** | Central **Threat Intelligence Artifact Cache** application identifier                                                               |

3. Configure **AI\_SOC\_MSSP\_Central\_Sync** (**AI SOC MSSP Central Sync**):
   1. Under **Authorization**, set **Username** and **Password** to match the central **Ingest Record from Client** webhook credentials.
   2. Set **PrivateToken** to a valid Swimlane admin personal access token for central API operations (TIAC create and update).
4. Save and verify both MSSP assets are active.

### Find the Central TI Cache Application ID

To find **Central\_TIAC\_App\_ID**:

1. In the **central tenant**, open **Threat Intelligence Artifact Cache**.
2. Copy the application identifier from the application URL or application settings (format varies by environment).
3. Enter that value in the client **AI SOC MSSP Client Configuration** asset.

You can also use the Swimlane API to retrieve the application identifier.

## Configuration Checklist

### Client Tenant

- **AI SOC Tenant Configuration** is configured (including **Private\_Token**).
- **TIA Central Sync Fields** is included on the client **Threat Intelligence** application **Support** tab, under **Threat Intelligence Metadata**.
- **Enrich TIA Record** (Create) flow is disabled in the client **AI SOC Main** playbook.
- **AI SOC MSSP Client Configuration** and **AI SOC MSSP Central Sync** are active.
- **Client\_Name** is set and matches how you identify the customer in central **Central Case Management** and **Central SOC Reporting**.
- **Central\_Webhook\_URL**, **Central\_Tenant\_ID**, and **Central\_TIAC\_App\_ID** are complete.

### Central Tenant

- **Ingest Record from Client** webhook is enabled with known credentials.
- **Central Case Management**, **Threat Intelligence Artifact Cache**, and **Central SOC Reporting** are accessible after install.

## Next Steps

| If you need to                                   | Go to                                                               |
| ------------------------------------------------ | ------------------------------------------------------------------- |
| Install solution layers and run first validation | [Getting Started for MSSP](docId\:ivvy6GXAjWc34xVMnNqC-)            |
| Add another customer tenant                      | [Onboard a Client Tenant](docId\:fGkw7if8VsR9_hchdeXUS)             |
| Work day to day in the central tenant            | [Use AI SOC for MSSP Central](docId\:gUalyzLQa-7ACfkpsZhCQ)         |
| Troubleshoot sync issues                         | [Validate and Troubleshoot MSSP Sync](docId\:QYEsknwk-RnSc1w1uax_D) |