Getting Started

This guide walks you through your first signal investigation in AI SOC. Follow these steps to understand the workflow and key features.

Investigation Approaches

AI SOC supports three complementary investigation approaches on the same Case Management record:

Approach	Summary
AI assisted investigation	Hero AI generates a plan; you run steps manually (Generate Investigation Plan, then Run or Run All Steps)
Agentic investigation	The Analysis agent runs without analyst intervention during the run—via Re-investigate on the Investigation widget (when Analysis Mode is Agentic) or a Signal Routing Rule
Automated investigation	An investigation playbook already ran from a Signal Routing Rule. Review the plan and verdict on the record

Hands-on steps for each approach are in Step 4: Choose How to Investigate, Step 5: Generate an Investigation Plan (AI Assisted), and Step 6: Run Agentic Investigation on the Record. Administrators who need agentic investigation to run automatically when signals arrive (for example, overnight triage) configure a routing rule after import—see Enable Agentic Investigation After Import later on this page.

Prerequisites

Before starting your first investigation:

Where to work: Primary triage and investigation use Case Management and dashboards in the AI SOC Workspace (for example Analyst Triage Queue).

Permissions configuration: Work with your organization to configure role-based permissions for AI SOC so users see the right actions (see Permissions Configuration below). Platform RBAC (legacy versus enhanced) also controls access to components and orchestration; see RBAC Considerations for AI SOC.

Access: You have access to the Case Management application and AI SOC Workspace

Hero AI: Hero AI is enabled for your tenant (required for plan generation and agentic investigation)

Permissions: You have appropriate permissions to view signals, generate plans, run investigation steps, and update records

Assets: Threat intelligence providers are configured (optional but recommended)

Permissions Configuration

User role permissions for AI SOC control what each role can see and do on Investigation, Remediation, Automation, Investigation Type, and Case Actions. Widget options alone are not always enough: users also need the right Turbine component and orchestration permissions for your account RBAC mode. For enhanced RBAC, analysts typically need Read and Execute on relevant components. For legacy RBAC, Orchestrator-level access is required for full AI SOC behavior. Routing rules that invoke AI SOC - Trigger Analysis Agent via Routing Rule also require a PAT token in an asset. See RBAC Considerations for AI SOC.

To configure widget permissions: open Applications & Applets → Case Management → Form Layout, select the widget, then click Edit Widget. Each option can be enabled or disabled and restricted to specific role names (use * to allow all roles).

There are four default permissions (Create, Read, Update, Delete) as a baseline; you can customize them or use Grant Full Permissions to grant full access for a role. These widgets also expose the options below.

Widget	Options
Investigation	generatePlan, modifyPlan, executePlan, useMarketplace, changeInvestigationType
Remediation	generatePlan, modifyPlan, executePlan, useMarketplace
Automation	display
Investigation Type	changeInvestigationType
Case Actions	display

Option	What it controls
generatePlan	Shows or hides the generate button and its text. On Investigation that is Generate Investigation Plan. On Remediation that is Generate Remediation Plan.
modifyPlan	Add, remove, and edit plan steps, and select components.
executePlan	Run the plan, or run individual steps. On Investigation, Mark as Done and Mark as Open stay hidden when executePlan is off.
useMarketplace	Use marketplace components when generating a plan or selecting components.
changeInvestigationType	Change the investigation type. The same option is on Investigation and on Investigation Type.
display	Show or hide the whole widget. This option is on Automation and Case Actions.

How to configure: In the widget editor, each option can be turned on or off and limited to specific role names. Use * for an option to allow all roles; enter one or more role names (comma-separated if supported) to restrict that option to those roles. The four baseline permissions (Create, Read, Update, Delete) apply to the widget as a whole; use Grant Full Permissions for a role if that role should have full access to the widget without per-option limits.

Enable generatePlan, modifyPlan, and executePlan on Investigation and Remediation for roles that generate and run plans. Enable useMarketplace only for roles that should use marketplace components. Use display on Automation and Case Actions to show or hide those widgets.

Configure these so that analysts have the access they need without exposing actions that should be restricted (for example, automation or marketplace use) to roles that should not have them.

If you do not see AI features (for example, Generate Investigation Plan): This is often due to Hero AI not being enabled or to RBAC/widget configuration. In Troubleshooting, see Hero AI Service Issues and Configuration Issues. Check that Hero AI is enabled, that your role is allowed on the Investigation widget, and that your application permissions include Case Management.

Your First Signal Investigation

Step 1: Open Case Management and Select a Record

Navigate to Application Records → Case Management

Review the signal list to find a signal to investigate

Tip: Start with a signal that has:

Status: New or In Progress (avoid Processing for your first run—see below)

Has observables (IPs, domains, hashes, URLs)

Has completed threat intelligence enrichment (check Threat Intelligence Status)

Click a record to open it

About Processing: New signals start in Processing until threat intel enrichment and signal evaluation (correlation, KB linking, Hero AI analysis) complete. Only then does status move to New, Closed, or Escalated. If you open a signal in Processing, wait for it to leave Processing before generating a plan, clicking Re-investigate, or expecting an AI verdict.

What to look for:

Tracking Id (for example, CASE-1234) for reference

Signal Source to understand where the alert originated

First Created timestamp to see how long the signal has been open

Step 2: Review Key Fields on the Signal

Start with the Case Header and the Case Details sidebar.

Case Owner and Owned by: Is the case assigned? If not, click Claim Case in Case Actions

Organization: Which organization this case belongs to

Signal Type: Alert, Phishing Email, or Manual

Signal Source: Where the alert came from (SIEM, EDR, email, and similar)

Status: Error, Processing, New, In Progress, Blocked, Escalated, or Closed. Processing means enrichment and signal evaluation are still running

Priority: P0 through P4, or Unknown

Severity: Critical, High, Medium, Low, Informational, or Unknown

Classification: Unknown, False Positive, True Positive, False Negative, or True Negative

AI Verdict and Manual Verdict: Unknown, Benign, Suspicious, or Malicious

Analysis Mode: AI Assisted, Automated, or Agentic

Actions to take:

If the case is unclaimed and you are investigating it, click Claim Case in Case Actions

Update Status to In Progress if you are actively working on it

Review Priority and Severity on the header

Step 3: Check Evidence and Context

Before investigating, review context on Case Investigation and the related tabs.

Knowledge Base Articles:

Open the Knowledge Base tab.

Purpose: Shows linked KB articles that provide investigation guidance

What to look for: Articles that match this signal type or observable patterns

Action: If relevant KB articles are linked, review them for standard procedures

Tip: KB articles provide baseline context that helps Hero AI generate better plans and agentic investigation runs

Threat Intelligence:

Open the Threat Intelligence widget on Case Investigation.

Purpose: Shows enrichment results for observables (IPs, domains, hashes, URLs)

What to look for:

Threat Intelligence Verdict: Overall verdict from TI providers

Observables: List of extracted observables and their verdicts

Enrichment Status: Are enrichments complete or still pending?

Action:

If enrichments are pending, wait for them to complete before generating a plan or starting investigation

Review observable verdicts to understand threat context

Click on an observable to view detailed TI information

Correlated Cases:

Purpose: Shows related signals and cases on the Case Investigation tab

What to look for:

Similar signals that may have already been investigated

Related cases that might contain relevant context

Correlation status (Pending, Processing, Complete)

Action:

Review similar signals to see how they were handled

Check if a case already exists for related activity

Use correlation to avoid duplicate work

Rules:

Open the Routing Rule tab.

Purpose: Shows routing rules that matched this signal

What to look for: Which rules triggered and which playbooks ran (including agentic investigation via AI SOC - Trigger Analysis Agent via Routing Rule)

Action: Understand what automated processing has already occurred. If a routing rule already ran agentic investigation overnight, the plan, verdict, and component results may be on the record when you open it.

Step 4: Choose How to Investigate

On the Case Investigation tab, you investigate in one of three ways:

Approach	When to use
AI assisted investigation	Hero AI generates a plan; you run steps manually (Generate Investigation Plan, then Run or Run All Steps) — continue with Step 5
Agentic investigation	The Analysis agent runs without analyst intervention during the run—via Re-investigate on Investigation (when Analysis Mode is Agentic) or a Signal Routing Rule — continue with Step 6
Automated investigation	An investigation playbook already ran from a Signal Routing Rule. Review the plan and verdict, then continue with Step 7

All approaches use the same Case Management record. This path covers investigation only—not automated remediation.

Step 5: Generate an Investigation Plan (AI Assisted)

Once you have reviewed the evidence, generate an AI-powered investigation plan.

Open the Case Investigation tab and find the Investigation widget

Pre-plan view: If no plan exists yet, you will see:

AI verdict summary (if available)

Confidence meter

MITRE ATT&CK context

Guidance message

Generate Investigation Plan

Click Generate Investigation Plan

Wait for Hero AI to analyze the signal and generate investigation steps. Progress detail messages update on the Investigation widget while generation runs (for example, reading signal details, threat intelligence, or building the plan). Plan actions are disabled until generation finishes.

The plan appears organized into phases: Preparation, Analysis, and Determination

What happens during plan generation:

Hero AI analyzes the signal data, observables, threat intelligence, and knowledge base articles

It generates investigation steps based on the signal context

Steps are mapped to available tools and integrations

Steps that require missing integrations will show an Install option

If plan generation fails:

Check that Hero AI is enabled (see Troubleshooting)

Verify observables exist on the signal

Ensure threat intelligence enrichment has completed

Check browser console for errors

When evidence or KBAs change after a plan exists, use Regenerate Investigation Plan instead of starting from scratch. See Investigation Plan Workflow.

Users without permission to install a component from a generated plan see a permissions notification. Ask an administrator or install the component from Library → Swimlane Content if needed.

Step 6: Run Agentic Investigation on the Record

When Analysis Mode is Agentic, the Analysis agent runs an end-to-end investigation without an analyst executing plan steps. Set Analysis Mode on the Case Header, in Investigation Type, or on Support, then click Re-investigate on the Investigation widget.

The agent reads case context, linked threat intelligence observables, knowledge base articles, correlated cases, and tenant components marked Visible to Hero AI. When the run finishes, Investigation Status is Complete and Agent Investigation shows COMPLETE. Reasoning includes Investigation Complete, the verdict and confidence, Summary, Key Evidence, and Confidence Limitations. Analysis Agent Request ID, Analysis Agent Session, and Analysis Status on Support track the run (Not Started, In Progress, Completed, Failed, Cancelled).

Open the signal after Processing completes (unless your tenant allows earlier start)

Set Analysis Mode to Agentic

On Investigation, click Re-investigate to start agentic investigation (which invokes AI SOC - Trigger Analysis Agent)

Watch the Investigation widget until Investigation Status is Complete and Agent Investigation shows COMPLETE

Open Reasoning and review the verdict, confidence, Summary, Key Evidence, and Confidence Limitations

Re-investigate again: Click Re-investigate after KBAs or evidence change materially. Confirm the dialog—re-investigating removes current agent progress and associated data, resets the case verdict to the initial verdict, and cannot be undone. Update linked Knowledge Base Articles before you confirm if you want the agent to follow new guidance.

To run agentic investigation automatically when signals arrive (for example, overnight triage), complete Enable Agentic Investigation After Import after you finish this walkthrough.

Step 7: Review and Execute Plan Steps

If a routing-rule analysis run or on-record Re-investigate already completed investigation, review the plan, component inputs and outputs, and verdict on the record. Adjust Manual Verdict if needed, then continue to remediation or automation.

For manual investigation, work through plan phases systematically.

Preparation Phase:

Purpose: Validate observables and confirm alert context

Typical steps: Enrich observables with multiple TI providers, get endpoint details

Action:

Review each step before running

Click Review to see what the step will do

Click Run for individual steps or Run All Steps for the entire phase

Wait for steps to complete and review results

Analysis Phase:

Purpose: Verify scope, impact, and lateral movement

Typical steps: Search SIEM/EDR for related activity, check for similar infections, get user details

Action:

Execute steps to gather evidence

Review results in the step timeline (data from all executed steps, in any phase, is saved to the record and written to the timeline)

Add notes if you modify or skip steps

Document findings in investigation comments in the linked case (comments and evidence are added to the case record, not the signal record)

Determination Phase:

Purpose: Finalize the verdict

Typical step: Generate verdict using AI SOC - CASE Hero AI Analysis

Action:

Run the verdict generation step (or review the verdict if agentic investigation or a routing-rule analysis run already set it)

Review the AI verdict, confidence, and reasoning

Set a Manual Verdict if you disagree with the AI verdict

Add investigation comments explaining your decision in the linked case (not on the signal record)

Tips for executing steps:

Steps that show Install need integrations to be installed first

Use Mark as Done if you have completed a step manually outside the system. Mark as Done and Mark as Open stay hidden when executePlan is off on Investigation

Use Delete Step to remove steps that are not relevant

Use Add Additional Step to include custom investigation steps

Step 8: Generate Remediation Plan

On Case Investigation, open the Remediation widget

Click Generate Remediation Plan when it is enabled (see note below)

Review the AI-generated remediation steps. Progress detail messages appear while Hero AI builds the plan.

Execute remediation steps as appropriate (remediation remains analyst-controlled even when you used agentic investigation)

Document any remediation actions taken in the linked case

If the verdict or investigation findings change, use Regenerate Remediation Plan in the same section. See Investigation Plan Workflow.

The Generate Remediation Plan button is disabled only when: (1) the investigation plan section does not exist, (2) a plan is currently being generated, or (3) a remediation plan has already been generated. In all other scenarios the button is enabled; you decide whether to generate a plan.

Recovery steps from a Generate Remediation Plan output (when you use that feature) are not included when you use Create a Playbook. Auto-generated investigation playbooks focus on investigation and containment (for example, isolate host). Adding recovery into the same automated run would often undo containment immediately (for example, rejoining a host after isolation). You should still automate recovery at scale by maintaining reusable recovery playbooks (for example, standard templates in Orchestration → Playbooks) and running them after containment is verified and change management allows, rather than performing one-off manual recovery for every case. You can seed those playbooks from the remediation plan once, then reuse them. See Troubleshooting.

Step 9: Document and Resolve

After completing the investigation, document your findings and resolve the record. Comments and evidence cannot be added to the signal record when your workflow requires a linked case; add them in the linked case for this record.

Document findings (in the linked case):

Open the case linked to this signal and add Investigation Comments explaining:

What you found

Why you reached your verdict

Any actions taken

Recommendations for follow-up

Update Investigation Summary with key findings in the case

Attach any relevant evidence files in the case if needed

Set the verdict (on the signal):

On the record, set Manual Verdict:

Malicious: Confirmed threat requiring response

Suspicious: Needs further investigation

Benign: False positive, no threat

Unknown: Insufficient data to determine

Set Classification (True Positive, False Positive, Unknown)

Update status:

Set Status to Closed when investigation is complete. Resolved is not a Status value in this package. Resolve Case in Case Actions is still configured to write Resolved.

If investigation is still open, use In Progress or New per your process. Escalated may be set automatically when the pending CASE resolution flow applies your tenant's verdict and confidence rules (see Operations and Guidance). You stay on the same Case Management record (prefix CASE-) for triage through resolution unless your organization uses an additional linked record.

Step 10: Create Automation (Optional)

If this signal pattern will repeat, create automation to handle similar signals in the future. Create a Playbook works after manual investigation or after an agentic investigation session—the suggested components come from the investigation plan or a Trigger Analysis Agent run.

Create a Triage Rule:

On Case Investigation, open the Automation widget and click Create a Triage Rule.

What gets created: A record is created in the Signal Routing Rules application (for example, RULE-29). A link to the new rule record is shown—click it to open the record. You can also open, edit, and enable the rule from Application Records → Signal Routing Rules or from the Routing Rule Management dashboard.

What you configure on the record: Rule Name (pre-populated from the signal name; edit as needed), Rule Application (for example, Case Management), Description (optional), and Enabled (off by default—turn on when ready). In the IF section, define conditions (for example, Signal Name contains "X", severity, source, observables) using the condition builder (AND/GROUP for multiple criteria). In Associated Playbook, select a playbook that uses Rule-Execute, then apply the rule to the playbook. See Building Routing Rule Playbooks.

The new rule is assigned Rule Order automatically (highest existing order excluding rules associated with AI SOC - Trigger Analysis Agent via Routing Rule, then +1), so specific triage rules stay before a correctly configured catch-all. Save the record, then enable the rule when ready.

What it does when enabled: The rule evaluates incoming signals. When a signal meets all of the rule's conditions, the associated playbook runs. To test without waiting for new signals, use Run this rule against pending signals from the rule record's Support tab. To reorder, enable, or edit rules later, use the Routing Rule Management dashboard (see AI SOC Applications).

Create a Playbook:

In the Automation section, click Create a Playbook. The playbook opens in a new window (not a slider).

The playbook builder opens with suggested components from your investigation plan or an agentic investigation session. Recovery steps from a remediation plan are not included (by design); see the note under Step 8. Add recovery through a separate reusable playbook or approved process.

Review and customize the playbook, then Save.

After you save, the associated routing rule is updated with this playbook. Links to the rule record and the playbook are shown so you can click to open either one. Enable the rule to run it on future signals.

To test immediately, use Run this rule against pending signals from the routing rule's Support tab.

If the investigation plan changed after you first opened the playbook builder, use Recreate Playbook in Automation to regenerate the associated playbook from the current plan. See Creating Automation.

To build or attach a playbook manually (duplicate, Orchestration, or generate-then-cancel template), see Building Routing Rule Playbooks.

Playbook creation requires browser pop-ups to be enabled for your Swimlane domain. If components are missing, check pop-up blocker settings or see Troubleshooting.

Enable Agentic Investigation After Import

For agentic investigation at scale (for example, overnight triage), create and enable a Signal Routing Rule after you install the solution packages. The packages ship the AI SOC - Trigger Analysis Agent via Routing Rule playbook and AI SOC - Trigger Analysis Agent component, but no pre-seeded Signal Routing Rule records. Routing rules reference playbooks in ways that do not import reliably with the package, so you create and enable rules after import.

On-record agentic investigation does not require a routing rule. Analysts can set Analysis Mode to Agentic and click Re-investigate on Investigation. See Step 6: Run Agentic Investigation on the Record. This section is for routing-rule agentic investigation at scale.

Quick Path

Step	Action
1	Confirm AI SOC Solution and AI SOC Trigger Analysis Agent content are installed from Library → Swimlane Content — see Installing and Configuring AI SOC Solution
2	In Orchestration → Playbooks, confirm AI SOC - Trigger Analysis Agent via Routing Rule exists (it ships disabled)
3	Configure a PAT token in the asset used by that playbook — see RBAC Considerations for AI SOC — Trigger Analysis Agent and Routing Rules
4	Enable AI SOC - Trigger Analysis Agent via Routing Rule in Orchestration when you are ready to use it
5	Create a Signal Routing Rules record (Application Records → Signal Routing Rules, or Routing Rule Management → Add New Rule)
6	Set IF conditions. For a catch-all agentic rule, set Rule Order to a high value such as 99999 so more specific routing rules evaluate first. Associated Playbook must be AI SOC - Trigger Analysis Agent via Routing Rule (required—not any high-order default rule), then Apply rule to playbook. Optionally name the rule AI Agentic Investigation
7	Enable the rule and test with Run Rule Against Pending Signals on the rule Support tab

Requirement: The catch-all for unmatched or first-seen signals must associate AI SOC - Trigger Analysis Agent via Routing Rule. Setting a high Rule Order without that playbook does not configure agentic catch-all behavior, and Create a Triage Rule may assign new rules an order after your catch-all. See Building Routing Rule Playbooks.

For condition design, rule order, and troubleshooting, see Building Routing Rule Playbooks and RBAC Considerations for AI SOC.

Common First-Time Mistakes to Avoid

Mistake 1: Generating plan before enrichment completes

Problem: Plan may be incomplete without TI context

Solution: Wait for Threat Intelligence Status to show complete before generating a plan or starting investigation

Mistake 1a: Expecting a plan or verdict while status is Processing

Problem: Cases in Processing have not yet completed evaluation. Generate Investigation Plan is on the widget, and the AI Verdict pill stays blank until Processing ends.

Solution: Wait until status changes to New, Closed, or Escalated before investigating or judging readiness.

Mistake 2: Not claiming signals

Problem: Multiple analysts may work on the same signal

Solution: Click Claim Case in Case Actions when you start work on a case

Mistake 3: Skipping evidence and context

Problem: Missing important context from KB articles, threat intelligence, or correlation

Solution: Review Knowledge Base, Threat Intelligence, Correlated Cases, and Routing Rule before you click Generate Investigation Plan or Re-investigate

Mistake 4: Not documenting deviations

Problem: Future investigations may repeat unnecessary steps

Solution: Add notes when you skip or modify AI-suggested steps

Mistake 5: Forgetting to set manual verdict

Problem: Signals resolved without verdicts do not improve AI learning

Solution: Always set Manual Verdict when resolving signals

Next Steps

After completing your first investigation:

Review the workflow: Understand how signals flow through your SOC

Read best practices: Review Operational Best Practices for optimization tips

Learn about applications: See AI SOC Applications for detailed application walkthroughs

Understand troubleshooting: Bookmark Troubleshooting for common issues