---
title: Configure Custom Assets
slug: solutions/configure-custom-assets
docTags: 
createdAt: 2026-03-04T10:43:18.219Z
---

AI SOC uses several **custom configuration assets** (key-value pair assets) that are not tied to a vendor. These control SLA, threat intelligence, and correlation behavior. Find them under **Orchestration** → **Assets**; the input names must match the action input keys used by playbooks and components. To change when **Case Management** records are automatically set to **Escalated** or **Closed** (for example, confidence thresholds), edit the **pending CASE resolution** flow in **Orchestration** → **Playbooks**; that behavior is not configured via assets.

### AI SOC General Configuration

The **AI\_SOC\_General\_Configuration** asset controls service-level agreement (SLA) timing used by the solution.

1. Navigate to **Orchestration** → **Assets**
2. Find and open **AI SOC General Configuration**
3. Under **Asset Inputs**, configure **SLA\_Hours**:
   - **Alert**: SLA in hours for alerts (default: 6)
   - **Phishing\_Triage**: SLA in hours for phishing triage signals (default: 6)
   - **Manual**: SLA in hours for manually created items (default: 6)

Adjust these values to match your organization’s response targets. Save the asset after making changes.

### AI SOC Threat Intelligence Configuration

The **AI\_SOC\_Threat\_Intelligence\_Configuration** asset controls which observables are enriched, which are ignored, which threat intelligence providers are used and their weights, and how risk scores map to verdicts. Configure this asset before enrichment will behave as expected.

1. Navigate to **Orchestration** → **Assets**
2. Find and configure the **AI SOC Threat Intelligence Configuration** asset
3. Configure the following sections:

**Observable Types to Enrich**

Specify which observable types are sent for enrichment. Only listed types are enriched.

- **Common types:** ip\_public, ip\_private, domain, email, url, hash, sha256, md5 (exact names may vary by install; use the values offered in the asset).
- Add types such as ip\_private if you have your own threat intelligence for private IP ranges.
- Remove types you do not want to enrich.

**Observable Parser Ignore List**

Configure ignore lists so certain observables are excluded from extraction and enrichment (alerts still ingest; matching observables are skipped and no TI lookups or TI records are created for them):

- **Regex**: Regular expression patterns to match and exclude observables (default: empty). Use for fine-grained exclusions.
- **IP\_CIDR\_Ranges**: Comma-separated IP CIDR ranges to exclude (default: for example 10.0.0.0/8, 172.16.0.0/12 for common private ranges).
- **Domains**: Comma-separated domains to exclude (default: for example outlook.com, gmail.com, o365.com, exchange.com).

**Threat Intelligence Providers**

Define which TI providers are used and their **Weight** for aggregation (used when calculating the Turbine Risk Score and combined verdicts):

1. For each provider, add an array entry with:
   - **Name**: Must exactly match the provider name used in the enrichment component (for example "VirusTotal", "Recorded Future", "URLHaus", "IPQualityScore", "AbuseIPDB", "ThreatGrid"). Case-sensitive.
   - **Weight**: Numeric weight (for example 1–30). Higher weight gives that provider more influence in the aggregated result.
2. Add a **Default** entry (Name: Default, Weight: for example 5) for any provider that does not have a matching name in the list.
3. You can add or remove providers to match the TI sources you use.

**Turbine Risk Score Thresholds**

Set the thresholds used to convert the calculated risk score into a verdict:

- **Benign**: Upper bound for benign (default: 0). Scores at or below this are benign.
- **Suspicious**: Threshold above which the verdict is suspicious (default: 300). Typically, scores from 300 up to the malicious threshold are suspicious.
- **Malicious**: Threshold at or above which the verdict is malicious (default: 600).

Risk scores above these thresholds drive the threat intelligence verdict classification shown on **Case Management **records.

### AI SOC Correlation Configuration

The **AI\_SOC\_Correlation\_Configuration** asset controls how signals are correlated with each other and with existing records.

1. Navigate to **Orchestration** → **Assets**
2. Find and open **AI SOC Correlation Configuration**
3. Under **Asset Inputs**, configure as needed (defaults are often sufficient):
   - **Days\_to\_Correlate**: Number of days back to consider for correlation (default: 7)
   - **Correlations\_to\_Return**: Maximum number of correlations to return per signal (default: 10)
   - **Minimum\_String\_Match\_Ratio**: Threshold for string similarity when matching (for example, 1 = exact match)
   - **Minimum\_Record\_Match\_Ratio**: Threshold for overall record similarity (for example, 0.5 = 50% match)
   - **Correlation\_Delay\_Minutes**: Delay in minutes before correlation runs (for example, 5)
   - **Maximum\_Records\_to\_Search**: How many **CASE** records to compare against the current record. Default 1000. **Maximum 5000.** Values above 5000 are capped at 5000.

Adjust these if you need more or fewer correlations, a longer lookback window, or different match sensitivity. Save the asset after making changes.

### AI SOC Tenant Configuration

The **AI\_SOC\_Tenant\_Configuration** asset (**AI SOC Tenant Configuration**) supplies personal access token (PAT)–based access for core AI SOC flows that invoke internal APIs and agents.

1. Navigate to **Orchestration** → **Assets**
2. Find and open **AI SOC Tenant Configuration**
3. Configure:

| **Input**          | **What to enter**                                                   |
| ------------------ | ------------------------------------------------------------------- |
| **Base\_URL**      | Your Swimlane host (for example `yourtenant.swimlane.app`)          |
| **Account\_Id**    | Account identifier for API routing                                  |
| **Tenant\_Id**     | Tenant identifier for API routing                                   |
| **Private\_Token** | Valid Swimlane PAT that belongs to an Orchestrator or Administrator |

4. Save the asset and set status to active when your environment requires it.

### Turbine Tenant Credentials

The **Turbine\_Tenant\_Credentials** asset (**Turbine Tenant Credentials**) supplies personal access token (PAT)–based Swimlane API access for core playbooks that call the Turbine or Swimlane APIs.

1. Navigate to **Orchestration** → **Assets**
2. Find and open **Turbine Tenant Credentials**
3. Configure:

| **Input**                   | **What to enter**                                                   |
| --------------------------- | ------------------------------------------------------------------- |
| **Personal\_Access\_Token** | Valid Swimlane PAT with permissions required by installed playbooks |
| **Host**                    | Your Swimlane host (match the format used in your tenant)           |
| **Tenant\_ID**              | Tenant identifier                                                   |
| **Account\_ID**             | Account identifier                                                  |

4. Save the asset and set status to active when your environment requires it.