Configure Ingestion Playbooks
AI SOC includes template playbooks for alert and email ingestion. These templates are designed to be duplicated and configured for your specific integrations. The AI SOC bundle also includes the AI Ingestion application, which you can use to build vendor connectors from OpenAPI specs and Hero AIβassisted Turbine Schema mapping for alert ingestion. For the full guide to the AI Ingestion widget (create connector components, run the ingestion process, map to Turbine Schema), see AI SOC Ingestionο»Ώ.
The template playbooks listed below should be duplicated first, then configured β do not edit the originals directly. Duplicating preserves the template for future reuse and keeps a clean baseline for additional integrations.
AI SOC - Alert Ingestion (Cron) - Template
Purpose: Pull alerts in bulk from source systems on a schedule.
Configuration Steps:
- Duplicate the template playbook (do not edit the original)
- Configure Placeholder - Get TEDS Alerts component:
- Set up connection to your alert source (SIEM, XDR, etc.)
- Configure authentication (API keys, OAuth, etc.)
- Map source alert fields to Turbine Schema format
- Configure search parameters to fetch alerts
- Configure AI SOC - Extend TEDS Alerts (Bulk) - Template component:
- Map vendor-specific fields to Case Management fields
- Preserve raw alert data if needed
- Add any custom field mappings
- Enable the playbook and configure the CRON schedule to match your alert source polling frequency
After Case Management records are created, Case Correlation (Time Delay) runs when the Case Correlation Date/Time on the case is reached. That playbook runs only when Date/Time Field Trigger is enabled. Configure correlation windows in the AI SOC Correlation Configuration assetβnot in the ingestion template.
Flow: Fetch alerts β Convert to Turbine Schema β Extend with custom fields β Deduplicate β Enrich observables β Create or update Case Management records (correlation runs when the Case Correlation Date/Time is reached)
The playbook uses the Ingest_Alert sensor which is triggered by the CRON schedule.
AI SOC - Alert Ingestion (Webhook) - Template
Purpose: Receive alerts in real-time via webhook.
Configuration Steps:
- Duplicate the template playbook (do not edit the original)
- Configure the webhook sensor:
- Navigate to Orchestration β Sensors
- Find the Ingest_Alert sensor (or create a new webhook sensor)
- Note the webhook URL provided
- Configure authentication if required (API keys, tokens, etc.)
- Enable the sensor
- Configure Placeholder - Get TEDS Alerts component (in the playbook):
- Map webhook payload fields to Turbine Schema format
- Ensure observable extraction is configured
- Handle webhook payload structure
- Configure AI SOC - Extend TEDS Alert component:
- Map vendor-specific fields to Case Management fields
- Preserve raw alert data in the alert-raw-json field
- Add any custom field mappings
- Enable the playbook and configure authentication on the webhook sensor as required
After Case Management records are created, Case Correlation (Time Delay) runs when the Case Correlation Date/Time on the case is reached. That playbook runs only when Date/Time Field Trigger is enabled.
Flow: Receive webhook β Convert to Turbine Schema β Extend with custom fields β Deduplicate β Enrich observables β Create or update Case Management records (correlation runs when the Case Correlation Date/Time is reached)
After configuration, provide the webhook URL to your alert source system (SIEM, XDR, and so on.) to start receiving alerts.
AI SOC - Phishing Ingestion (Cron) - Template
Purpose: Process phishing emails in bulk from email sources on a schedule.
Configuration Steps:
- Duplicate the template playbook (do not edit the original)
- Configure Placeholder - Get TEDS Emails component:
- Set up connection to email source (Microsoft Graph API, IMAP, etc.)
- Configure authentication (OAuth for Microsoft Graph, credentials for IMAP)
- Configure email search parameters (folder, date range, filters)
- Map email fields to Email Turbine Schema format
- Configure AI SOC - Extend TEDS Alerts (Bulk) - Template component:
- Map email-specific fields to Case Management fields
- Extract observables (URLs, sender addresses, attachment hashes)
- Preserve raw email data
- Enable the playbook and configure the CRON schedule to check for new emails
After Case Management records are created, Case Correlation (Time Delay) runs when the Case Correlation Date/Time on the case is reached. That playbook runs only when Date/Time Field Trigger is enabled.
Flow: Retrieve emails β Convert to Email Turbine Schema β Extend with custom fields β Deduplicate β Enrich observables β Create or update Case Management records (correlation runs when the Case Correlation Date/Time is reached)
The playbook uses the Ingest_Email sensor which is triggered by the CRON schedule. Ensure your email source is accessible and authentication is properly configured.
AI SOC - Test Email Ingestion (Webhook)
Purpose: Receive a test email on a webhook and forward it to the email ingestion flow. The classic playbook is Ingest Webhook Email. The sensor is Test Email Ingestion (AI SOC).
Configuration Steps:
- Duplicate AI SOC - Test Email Ingestion (Webhook) before you change it.
- Open Orchestration β Sensors and confirm Test Email Ingestion (AI SOC) is enabled.
- Post a test email to that webhook and confirm a Case Management record is created.
Map Vendor Fields to Case Management
The ingestion templates map standard TEDS properties to Case Management automatically. Vendor-specific values that have no TEDS equivalent are mapped through the Extend TEDS component in your duplicated playbook.
- In Case Management, create a custom field for each vendor value you want to retain, and note the field key of each field.
- Open the Extend TEDS component in your duplicated playbook:
- Cron templates use AI SOC - Extend TEDS Alerts (Bulk) - Template with the Extend TEDS Object transformation.
- The webhook template uses AI SOC - Extend TEDS Alert with the Add Custom TEDS Values transformation.
- Add your mappings to the $extracted_fields object in the JSONata expression, reading values from the raw alert or supplying static values:
$extracted_fields := {
"alert-host-criticality": $raw_alert.host.criticality,
"vendor-rule-id": $raw_alert.detection.rule.id,
"ingestion-source": "Static Value"
} ;- Save the component, then run the playbook with a sample alert and confirm the values appear on the Case Management record.
Each key in $extracted_fields must match the Case Management field key exactly, not the field label. Keys that do not match an existing field key are ignored. In the bulk template, do not change the code below the Do Not Modify Below commentβAI SOC - Create Alert Case Record expects the structure that block returns.
AI SOC - Create Alert Case Record checks whether extended fields are present and patches the Case Management record with them after the record is created or updated. If $extracted_fields is empty, the record holds standard TEDS properties only.
Post-Installation Checklist
After installation and initial configuration, verify:
- [ ] All applications are present and accessible
- [ ] Hero AI is enabled and accessible
- [ ] Threat intelligence assets are configured and tested
- [ ] Ingestion playbooks are duplicated and configured
- [ ] Test alerts can be ingested successfully
- [ ] Observables are extracted correctly
- [ ] Threat intelligence enrichment runs automatically
- [ ] Investigation plans can be generated
- [ ] Dashboards and reports are accessible
Related Documentation
- Getting Startedο»Ώ- Your first signal investigation
- AI SOC Applicationsο»Ώ- Application walkthroughs
- Integration Examplesο»Ώ - Integration configuration examples
- Troubleshootingο»Ώ - Common installation and configuration issues