Configure Ingestion Playbooks

ai soc includes template playbooks for alert and email ingestion these templates are designed to be duplicated and configured for your specific integrations the ai soc bundle also includes the ai ingestion application, which you can use to build vendor connectors from openapi specs and hero ai–assisted turbine schema mapping for alert ingestion for the full guide to the ai ingestion widget (create connector components, run the ingestion process, map to turbine schema), see ai soc ingestion docid 0p9qwz3o 0j5dnkpjugmq the template playbooks listed below should be duplicated first, then configured — do not edit the originals directly duplicating preserves the template for future reuse and keeps a clean baseline for additional integrations ai soc alert ingestion (cron) template purpose pull alerts in bulk from source systems on a schedule configuration steps duplicate the template playbook (do not edit the original) configure placeholder get teds alerts component set up connection to your alert source (siem, xdr, etc ) configure authentication (api keys, oauth, etc ) map source alert fields to turbine schema format configure search parameters to fetch alerts configure ai soc extend teds alerts (bulk) template component map vendor specific fields to case management fields preserve raw alert data if needed add any custom field mappings enable the playbook and configure the cron schedule to match your alert source polling frequency after case management records are created, correlation runs on a schedule through ai soc main using ai soc get case records to correlate against and ai soc correlate current case record configure correlation windows in the ai soc correlation configuration asset—not in the ingestion template flow fetch alerts → convert to turbine schema → extend with custom fields → deduplicate → enrich observables → create or update case management records (correlation runs separately on a schedule) the playbook uses the ingest alert sensor which is triggered by the cron schedule ai soc alert ingestion (webhook) template purpose receive alerts in real time via webhook configuration steps duplicate the template playbook (do not edit the original) configure the webhook sensor navigate to orchestration → sensors find the ingest alert sensor (or create a new webhook sensor) note the webhook url provided configure authentication if required (api keys, tokens, etc ) enable the sensor configure placeholder get teds alerts component (in the playbook) map webhook payload fields to turbine schema format ensure observable extraction is configured handle webhook payload structure configure ai soc extend teds alert component map vendor specific fields to case management fields preserve raw alert data in the alert raw json field add any custom field mappings enable the playbook and configure authentication on the webhook sensor as required after case management records are created, correlation runs on a schedule through ai soc main using ai soc get case records to correlate against and ai soc correlate current case record flow receive webhook → convert to turbine schema → extend with custom fields → deduplicate → enrich observables → create or update case management records (correlation runs separately on a schedule) after configuration, provide the webhook url to your alert source system (siem, xdr, and so on ) to start receiving alerts ai soc phishing ingestion (cron) template purpose process phishing emails in bulk from email sources on a schedule configuration steps duplicate the template playbook (do not edit the original) configure placeholder get teds emails component set up connection to email source (microsoft graph api, imap, etc ) configure authentication (oauth for microsoft graph, credentials for imap) configure email search parameters (folder, date range, filters) map email fields to email turbine schema format configure ai soc extend teds alerts (bulk) template component map email specific fields to case management fields extract observables (urls, sender addresses, attachment hashes) preserve raw email data enable the playbook and configure the cron schedule to check for new emails after case management records are created, correlation runs on a schedule through ai soc main using ai soc get case records to correlate against and ai soc correlate current case record flow retrieve emails → convert to email turbine schema → extend with custom fields → deduplicate → enrich observables → create or update case management records (correlation runs separately on a schedule) the playbook uses the ingest email sensor which is triggered by the cron schedule ensure your email source is accessible and authentication is properly configured map vendor fields to case management the ingestion templates map standard teds properties to case management automatically vendor specific values that have no teds equivalent are mapped through the extend teds component in your duplicated playbook in case management , create a custom field for each vendor value you want to retain, and note the field key of each field open the extend teds component in your duplicated playbook cron templates use ai soc extend teds alerts (bulk) template with the extend teds object transformation the webhook template uses ai soc extend teds alert with the add custom teds values transformation add your mappings to the $extracted fields object in the jsonata expression, reading values from the raw alert or supplying static values $extracted fields = { "alert host criticality" $raw alert host criticality, "vendor rule id" $raw alert detection rule id, "ingestion source" "static value" } ; save the component, then run the playbook with a sample alert and confirm the values appear on the case management record each key in $extracted fields must match the case management field key exactly, not the field label keys that do not match an existing field key are ignored in the bulk template, do not change the code below the do not modify below comment— ai soc create alert case record expects the structure that block returns ai soc create alert case record checks whether extended fields are present and patches the case management record with them after the record is created or updated if $extracted fields is empty, the record holds standard teds properties only post installation checklist after installation and initial configuration, verify \[ ] all applications are present and accessible \[ ] hero ai is enabled and accessible \[ ] threat intelligence assets are configured and tested \[ ] ingestion playbooks are duplicated and configured \[ ] test alerts can be ingested successfully \[ ] observables are extracted correctly \[ ] threat intelligence enrichment runs automatically \[ ] investigation plans can be generated \[ ] dashboards and reports are accessible related documentation getting started docid\ p7qjquayekczhpxeppwcp your first signal investigation ai soc applications docid\ uosuzrpsl6hfe9d6br5az application walkthroughs integration examples docid\ vm1j5 5rzqx4lc0hqoaiv integration configuration examples troubleshooting docid\ cknuxqv85k9lu0ocqv218 common installation and configuration issues