Configure Custom Assets

AI SOC uses several custom configuration assets (key-value pair assets) that are not tied to a vendor. These control SLA, confidence thresholds, threat intelligence, and correlation behavior. Find them under Orchestration → Assets; the input names must match the action input keys used by playbooks and components.

AI SOC General Configuration

The AI_SOC_General_Configuration asset sets the SLA window for Case Management records. Every source uses the same Baseline. Priority selects a separate hour value.

Navigate to Orchestration → Assets.

Open AI SOC General Configuration.

Under SLA_Hours, set Baseline and SLA_by_Priority using the table below.

Input	Default hours	When the solution uses it
Baseline	6	New cases. Also any case whose Priority is not P0, P1, P2, P3, or P4.
P0	2	Cases with Priority P0.
P1	4	Cases with Priority P1.
P2	5	Cases with Priority P2.
P3	6	Cases with Priority P3.
P4	7	Cases with Priority P4.

P0 through P4 are the inputs under SLA_by_Priority. These defaults give P0 the shortest window and P4 the longest. Change the hours to match your response targets.

Save the asset.

Case Description Length Threshold defaults to 250. Ingestion compares the calculated case description length with this value. When the description is longer, or when the description is empty, ingestion prepares the description fields before correlation timing continues.

Confidence Thresholds default to 8 for Malicious or Suspicious and 8 for Benign. Pending CASE Resolution uses these values with the AI verdict. A Malicious or Suspicious verdict at or above the first value sets Requires Attention, and sets Status to Escalated when the case is Processing, New, or Error. A Benign verdict at or above the second value sets Status to Closed.

Error Threshold defaults to 300 minutes for System Flow and 300 minutes for AI Analysis. Search Frozen Cases uses these values when it looks for cases that have stayed in those states.

Baseline is saved on the case when the case is created. SLA by Priority is applied from this asset when Priority is P0, P1, P2, P3, or P4. A breach notification is sent to the current owner. See Case Management (CASE).

AI SOC Clients List

The AI SOC Clients List asset supplies the client names on the Manual Case Creation tab.

Navigate to Orchestration → Assets.

Open AI SOC Clients List.

Under Client List, add one client name per item. The package includes one placeholder item.

Save the asset.

Those names are the client choices on Create Case. See Case Management (CASE).

AI SOC Threat Intelligence Configuration

The AI_SOC_Threat_Intelligence_Configuration asset controls which observables are enriched, which are ignored, which threat intelligence providers are used and their weights, and how risk scores map to verdicts. Configure this asset before enrichment will behave as expected.

Navigate to Orchestration → Assets

Find and configure the AI SOC Threat Intelligence Configuration asset

Configure the following sections:

Observable Types to Enrich

Specify which observable types are sent for enrichment. Only listed types are enriched.

Common types: ip_public, ip_private, domain, email, url, hash, sha256, md5 (exact names may vary by install; use the values offered in the asset).

Add types such as ip_private if you have your own threat intelligence for private IP ranges.

Remove types you do not want to enrich.

Observable Parser Ignore List

Configure ignore lists so certain observables are excluded from extraction and enrichment (alerts still ingest; matching observables are skipped and no TI lookups or TI records are created for them):

Regex: Regular expression patterns to match and exclude observables (default: empty). Use for fine-grained exclusions.

IP_CIDR_Ranges: Comma-separated IP CIDR ranges to exclude (default: for example 10.0.0.0/8, 172.16.0.0/12 for common private ranges).

Domains: Comma-separated domains to exclude (default: for example outlook.com, gmail.com, o365.com, exchange.com).

Threat Intelligence Providers

Define which TI providers are used and their Weight for aggregation (used when calculating the Turbine Risk Score and combined verdicts):

For each provider, add an array entry with:

Name: Must exactly match the provider name used in the enrichment component (for example "VirusTotal", "Recorded Future", "URLHaus", "IPQualityScore", "AbuseIPDB", "ThreatGrid"). Case-sensitive.

Weight: Numeric weight (for example 1–30). Higher weight gives that provider more influence in the aggregated result.

Add a Default entry (Name: Default, Weight: for example 5) for any provider that does not have a matching name in the list.

You can add or remove providers to match the TI sources you use.

Turbine Risk Score Thresholds

Set the thresholds used to convert the calculated risk score into a verdict:

Benign: Upper bound for benign (default: 0). Scores at or below this are benign.

Suspicious: Threshold above which the verdict is suspicious (default: 300). Typically, scores from 300 up to the malicious threshold are suspicious.

Malicious: Threshold at or above which the verdict is malicious (default: 600).

Risk scores above these thresholds drive the threat intelligence verdict classification shown on Case Management records.

AI SOC Correlation Configuration

The AI_SOC_Correlation_Configuration asset controls how signals are correlated with each other and with existing records.

Navigate to Orchestration → Assets

Find and open AI SOC Correlation Configuration

Under Asset Inputs, configure as needed (defaults are often sufficient):

Days_to_Correlate: Number of days back to consider for correlation. Default 1.

Correlations_to_Return: Maximum number of correlations to return per signal. Default 10.

Minimum_String_Match_Ratio: Threshold for string similarity when matching. Default 0.9.

Minimum_Record_Match_Ratio: Threshold for overall record similarity. Default 0.75.

Correlation_Delay_Minutes: Delay in minutes before correlation runs. Default 1.

Maximum_Records_to_Search: How many CASE records to compare against the current record. Default 1000. Maximum 5000. Values above 5000 are capped at 5000.

Maximum_Concurrent_Correlations: How many correlations can run at the same time. Default 10.

Adjust these if you need more or fewer correlations, a longer lookback window, or different match sensitivity. Save the asset after making changes.

AI SOC Tenant Configuration

The AI_SOC_Tenant_Configuration asset (AI SOC Tenant Configuration) supplies personal access token (PAT)–based access for core AI SOC flows that invoke internal APIs and agents.

Navigate to Orchestration → Assets

Find and open AI SOC Tenant Configuration

Configure:

Input	What to enter
Base_URL	Your Swimlane host (for example yourtenant.swimlane.app)
Account_Id	Account identifier for API routing
Tenant_Id	Tenant identifier for API routing
Private_Token	Valid Swimlane PAT that belongs to an Orchestrator or Administrator

Save the asset and set status to active when your environment requires it.

AI SOC After Actions Report Configuration

The AI SOC After Actions Report Configuration asset supplies the logo on the after-actions PDF.

Navigate to Orchestration → Assets.

Open AI SOC After Actions Report Configuration.

Set logo, then save the asset.

AI SOC Test Record Generation Configuration

AI SOC Alert Case Generator and AI SOC Phishing Email Case Generator use AI SOC Test Record Generation Configuration to create sample records.

Navigate to Orchestration → Assets.

Open AI SOC Test Record Generation Configuration.

Set how many alerts and emails to generate, and the webhook URLs those playbooks call.

Save the asset.

This package does not include a Turbine Tenant Credentials asset. Tenant API access for this solution is AI SOC Tenant Configuration.