Configure Custom Assets
AI SOC uses several custom configuration assets (key-value pair assets) that are not tied to a vendor. These control SLA, threat intelligence, and correlation behavior. Find them under Orchestration → Assets; the input names must match the action input keys used by playbooks and components. To change when Case Management records are automatically set to Escalated or Closed (for example, confidence thresholds), edit the pending CASE resolution flow in Orchestration → Playbooks; that behavior is not configured via assets.
AI SOC General Configuration
The AI_SOC_General_Configuration asset controls service-level agreement (SLA) timing used by the solution.
- Navigate to Orchestration → Assets
- Find and open AI SOC General Configuration
- Under Asset Inputs, configure SLA_Hours:
- Alert: SLA in hours for alerts (default: 6)
- Phishing_Triage: SLA in hours for phishing triage signals (default: 6)
- Manual: SLA in hours for manually created items (default: 6)
Adjust these values to match your organization’s response targets. Save the asset after making changes.
AI SOC Threat Intelligence Configuration
The AI_SOC_Threat_Intelligence_Configuration asset controls which observables are enriched, which are ignored, which threat intelligence providers are used and their weights, and how risk scores map to verdicts. Configure this asset before enrichment will behave as expected.
- Navigate to Orchestration → Assets
- Find and configure the AI SOC Threat Intelligence Configuration asset
- Configure the following sections:
Observable Types to Enrich
Specify which observable types are sent for enrichment. Only listed types are enriched.
- Common types: ip_public, ip_private, domain, email, url, hash, sha256, md5 (exact names may vary by install; use the values offered in the asset).
- Add types such as ip_private if you have your own threat intelligence for private IP ranges.
- Remove types you do not want to enrich.
Observable Parser Ignore List
Configure ignore lists so certain observables are excluded from extraction and enrichment (alerts still ingest; matching observables are skipped and no TI lookups or TI records are created for them):
- Regex: Regular expression patterns to match and exclude observables (default: empty). Use for fine-grained exclusions.
- IP_CIDR_Ranges: Comma-separated IP CIDR ranges to exclude (default: for example 10.0.0.0/8, 172.16.0.0/12 for common private ranges).
- Domains: Comma-separated domains to exclude (default: for example outlook.com, gmail.com, o365.com, exchange.com).
Threat Intelligence Providers
Define which TI providers are used and their Weight for aggregation (used when calculating the Turbine Risk Score and combined verdicts):
- For each provider, add an array entry with:
- Name: Must exactly match the provider name used in the enrichment component (for example "VirusTotal", "Recorded Future", "URLHaus", "IPQualityScore", "AbuseIPDB", "ThreatGrid"). Case-sensitive.
- Weight: Numeric weight (for example 1–30). Higher weight gives that provider more influence in the aggregated result.
- Add a Default entry (Name: Default, Weight: for example 5) for any provider that does not have a matching name in the list.
- You can add or remove providers to match the TI sources you use.
Turbine Risk Score Thresholds
Set the thresholds used to convert the calculated risk score into a verdict:
- Benign: Upper bound for benign (default: 0). Scores at or below this are benign.
- Suspicious: Threshold above which the verdict is suspicious (default: 300). Typically, scores from 300 up to the malicious threshold are suspicious.
- Malicious: Threshold at or above which the verdict is malicious (default: 600).
Risk scores above these thresholds drive the threat intelligence verdict classification shown on Case Management records.
AI SOC Correlation Configuration
The AI_SOC_Correlation_Configuration asset controls how signals are correlated with each other and with existing records.
- Navigate to Orchestration → Assets
- Find and open AI SOC Correlation Configuration
- Under Asset Inputs, configure as needed (defaults are often sufficient):
- Days_to_Correlate: Number of days back to consider for correlation (default: 7)
- Correlations_to_Return: Maximum number of correlations to return per signal (default: 10)
- Minimum_String_Match_Ratio: Threshold for string similarity when matching (for example, 1 = exact match)
- Minimum_Record_Match_Ratio: Threshold for overall record similarity (for example, 0.5 = 50% match)
- Correlation_Delay_Minutes: Delay in minutes before correlation runs (for example, 5)
- Maximum_Records_to_Search: How many CASE records to compare against the current record. Default 1000. Maximum 5000. Values above 5000 are capped at 5000.
Adjust these if you need more or fewer correlations, a longer lookback window, or different match sensitivity. Save the asset after making changes.
AI SOC Tenant Configuration
The AI_SOC_Tenant_Configuration asset (AI SOC Tenant Configuration) supplies personal access token (PAT)–based access for core AI SOC flows that invoke internal APIs and agents.
- Navigate to Orchestration → Assets
- Find and open AI SOC Tenant Configuration
- Configure:
Input | What to enter |
|---|---|
Base_URL | Your Swimlane host (for example yourtenant.swimlane.app) |
Account_Id | Account identifier for API routing |
Tenant_Id | Tenant identifier for API routing |
Private_Token | Valid Swimlane PAT that belongs to an Orchestrator or Administrator |
- Save the asset and set status to active when your environment requires it.
Turbine Tenant Credentials
The Turbine_Tenant_Credentials asset (Turbine Tenant Credentials) supplies personal access token (PAT)–based Swimlane API access for core playbooks that call the Turbine or Swimlane APIs.
- Navigate to Orchestration → Assets
- Find and open Turbine Tenant Credentials
- Configure:
Input | What to enter |
|---|---|
Personal_Access_Token | Valid Swimlane PAT with permissions required by installed playbooks |
Host | Your Swimlane host (match the format used in your tenant) |
Tenant_ID | Tenant identifier |
Account_ID | Account identifier |
- Save the asset and set status to active when your environment requires it.