---
title: Configure Ingestion Playbooks
slug: solutions/configure-ingestion-playbooks
docTags: 
createdAt: 2026-03-04T10:40:27.196Z
---

AI SOC includes template playbooks for alert and email ingestion. These templates are designed to be duplicated and configured for your specific integrations. The AI SOC bundle also includes the **AI Ingestion **application, which you can use to build vendor connectors from OpenAPI specs and Hero AI–assisted Turbine Schema mapping for alert ingestion. For the full guide to the AI Ingestion widget (create connector components, run the ingestion process, map to Turbine Schema), see [AI SOC Ingestion](docId:0p9Qwz3o-0J5DNkPJUGmq).

:::hint{type="warning"}
The template playbooks listed below should be **duplicated first, then configured** — do not edit the originals directly. Duplicating preserves the template for future reuse and keeps a clean baseline for additional integrations.
:::

### AI SOC - Alert Ingestion (Cron) - Template

**Purpose:** Pull alerts in bulk from source systems on a schedule.

**Configuration Steps:**

1. Duplicate the template playbook (do not edit the original)
2. Configure **Placeholder - Get TEDS Alerts** component:
   - Set up connection to your alert source (SIEM, XDR, etc.)
   - Configure authentication (API keys, OAuth, etc.)
   - Map source alert fields to Turbine Schema format
   - Configure search parameters to fetch alerts
3. Configure **AI SOC - Extend TEDS Alerts (Bulk) - Template** component:
   - Map vendor-specific fields to **Case Management** fields
   - Preserve raw alert data if needed
   - Add any custom field mappings
4. Enable the playbook and configure the CRON schedule to match your alert source polling frequency

:::hint{type="info"}
After **Case Management** records are created, correlation runs on a schedule through **AI SOC - Main** using **AI SOC - Get CASE Records to Correlate Against** and **AI SOC - Correlate Current Case Record**. Configure correlation windows in the **AI SOC Correlation Configuration** asset—not in the ingestion template.
:::

**Flow:** Fetch alerts → Convert to Turbine Schema → Extend with custom fields → Deduplicate → Enrich observables → Create or update **Case Management** records (correlation runs separately on a schedule)

:::hint{type="info"}
The playbook uses the **Ingest\_Alert** sensor which is triggered by the CRON schedule.
:::

### AI SOC - Alert Ingestion (Webhook) - Template

**Purpose:** Receive alerts in real-time via webhook.

**Configuration Steps:**

1. Duplicate the template playbook (do not edit the original)
2. Configure the webhook sensor:
   - Navigate to **Orchestration** → **Sensors**
   - Find the **Ingest\_Alert** sensor (or create a new webhook sensor)
   - Note the webhook URL provided
   - Configure authentication if required (API keys, tokens, etc.)
   - Enable the sensor
3. Configure **Placeholder - Get TEDS Alerts** component (in the playbook):
   - Map webhook payload fields to Turbine Schema format
   - Ensure observable extraction is configured
   - Handle webhook payload structure
4. Configure **AI SOC - Extend TEDS Alert** component:
   - Map vendor-specific fields to **Case Management** fields
   - Preserve raw alert data in the alert-raw-json field
   - Add any custom field mappings
5. Enable the playbook and configure authentication on the webhook sensor as required

:::hint{type="info"}
After **Case Management** records are created, correlation runs on a schedule through **AI SOC - Main** using **AI SOC - Get CASE Records to Correlate Against** and **AI SOC - Correlate Current Case Record**.
:::

**Flow:** Receive webhook → Convert to Turbine Schema → Extend with custom fields → Deduplicate → Enrich observables → Create or update **Case Management** records (correlation runs separately on a schedule)

:::hint{type="info"}
After configuration, provide the webhook URL to your alert source system (SIEM, XDR, and so on.) to start receiving alerts.
:::

### AI SOC - Phishing Ingestion (Cron) - Template

**Purpose:** Process phishing emails in bulk from email sources on a schedule.

**Configuration Steps:**

1. Duplicate the template playbook (do not edit the original)
2. Configure **Placeholder - Get TEDS Emails** component:
   - Set up connection to email source (Microsoft Graph API, IMAP, etc.)
   - Configure authentication (OAuth for Microsoft Graph, credentials for IMAP)
   - Configure email search parameters (folder, date range, filters)
   - Map email fields to Email Turbine Schema format
3. Configure **AI SOC - Extend TEDS Alerts (Bulk) - Template** component:
   - Map email-specific fields to **Case Management** fields
   - Extract observables (URLs, sender addresses, attachment hashes)
   - Preserve raw email data
4. Enable the playbook and configure the CRON schedule to check for new emails

:::hint{type="info"}
After **Case Management** records are created, correlation runs on a schedule through **AI SOC - Main** using **AI SOC - Get CASE Records to Correlate Against** and **AI SOC - Correlate Current Case Record**.
:::

**Flow:** Retrieve emails → Convert to Email Turbine Schema → Extend with custom fields → Deduplicate → Enrich observables → Create or update **Case Management** records (correlation runs separately on a schedule)

:::hint{type="info"}
The playbook uses the **Ingest\_Email** sensor which is triggered by the CRON schedule. Ensure your email source is accessible and authentication is properly configured.
:::

## Map Vendor Fields to Case Management

The ingestion templates map standard TEDS properties to **Case Management** automatically. Vendor-specific values that have no TEDS equivalent are mapped through the **Extend TEDS** component in your duplicated playbook.

1. In **Case Management**, create a custom field for each vendor value you want to retain, and note the **field key** of each field.
2. Open the **Extend TEDS** component in your duplicated playbook:
   - Cron templates use **AI SOC - Extend TEDS Alerts (Bulk) - Template** with the **Extend TEDS Object** transformation.
   - The webhook template uses **AI SOC - Extend TEDS Alert** with the **Add Custom TEDS Values** transformation.
3. Add your mappings to the `$extracted_fields` object in the JSONata expression, reading values from the raw alert or supplying static values:

```text
$extracted_fields := {
    "alert-host-criticality": $raw_alert.host.criticality,
    "vendor-rule-id": $raw_alert.detection.rule.id,
    "ingestion-source": "Static Value"
} ;
```

4. Save the component, then run the playbook with a sample alert and confirm the values appear on the **Case Management** record.

:::hint{type="warning"}
Each key in `$extracted_fields` must match the **Case Management** field key exactly, not the field label. Keys that do not match an existing field key are ignored. In the bulk template, do not change the code below the `Do Not Modify Below` comment—**AI SOC - Create Alert Case Record** expects the structure that block returns.
:::

:::hint{type="info"}
**AI SOC - Create Alert Case Record** checks whether extended fields are present and patches the **Case Management** record with them after the record is created or updated. If `$extracted_fields` is empty, the record holds standard TEDS properties only.
:::

## Post-Installation Checklist

After installation and initial configuration, verify:

- \[ ] All applications are present and accessible
- \[ ] Hero AI is enabled and accessible
- \[ ] Threat intelligence assets are configured and tested
- \[ ] Ingestion playbooks are duplicated and configured
- \[ ] Test alerts can be ingested successfully
- \[ ] Observables are extracted correctly
- \[ ] Threat intelligence enrichment runs automatically
- \[ ] Investigation plans can be generated
- \[ ] Dashboards and reports are accessible

## Related Documentation

- [Getting Started](docId\:p7QJQUayeKczHPxEpPWcp)- Your first signal investigation
- [AI SOC Applications](docId\:UOSUZRpSl6hFe9d6Br5az)- Application walkthroughs
- [Integration Examples](docId\:vm1j5-5rzQX4LC0HqoAIV) - Integration configuration examples
- [Troubleshooting](docId\:cKnuXQV85k9lu0OCqV218) - Common installation and configuration issues