Configure the Application After Import

Complete the following steps after AI SOC (including AI Ingestion) is installed in your tenant and before you use the widget.

Add an Application Description

The AI Ingestion application has Hero AI visibility turned on by default. For Hero AI to answer questions accurately about the application, the description must explain what the application contains and how it's used. To add a description:

Open the AI Ingestion application and select App Settings.

Enter a description in the Description field. Use the following as a starting point:The AI Ingestion (AI) application provides a guided workflow for building vendor-specific alert ingestion components for the AI SOC pipeline. It stores records of ingestion configurations organized by vendor source.

Save your changes.

Assign Workspace Roles

The AI Ingestion Workspace has no roles assigned by default. To grant access:

Go to the Management tab, open Workspaces, and then open AI Ingestion Workspace.

Select Edit and open the Permissions tab.

Use Add Roles to add the role(s) that should have access to this workspace, and set the appropriate permissions (Read, Update, and so on) for each role. Anyone with those roles assigned to them will have access to the AI Ingestion application.

Enable Hero AI Visibility for the Vendor Product Field (Optional)

The Vendor Product field has Hero AI visibility turned off by default. To let Hero AI query and filter by vendor:

Open the AI Ingestion application in Application Builder and select the Vendor Product field.

Turn on Visible to Hero AI.

Enter a field description, for example: The name of the vendor or source system that submitted this record. Example values: CrowdStrike, Splunk, Palo Alto.

Save your changes.

View Ingestion Audit Information

The AI Ingestion application includes an Audit tab that displays the same fields described above (such as Vendor Product, API Specification Uploaded, and Name of component(s) generated). Use the Audit tab to review ingestion configuration and activity; no additional report configuration is required.

Considerations

Keep the following in mind when you use AI Ingestion:

Prebuilt connector credentials are not bundled with the solution. Reconfigure any HTTP assets or credentials after installation or content import.

The workflow has no stages configured on import. It is enabled but empty. Configure stages and actions before use.

The application acronym is AI and the Tracking Id prefix is AI-. If you deploy multiple instances of this application, update the acronym and prefix to avoid ID conflicts.

Hero AI is required for AI-assisted widget features. If Hero AI isn't enabled, you can still use the widget's manual path to select endpoints and configure components.

Records, record history, and secure key store values are not part of the installed solution definition and are not transferred when you import content.

AI SOC SolutionAI SOC Solution — Overview of the AI SOC solution

Installing and Configuring AI SOC SolutionInstallation and Configuration — Install AI SOC and configure ingestion playbooks

Installing and Configuring AI SOC SolutionIntegration Examples — Connect SIEM, EDR, and other tools