---
title: Getting Started for MSSP
slug: solutions/getting-started-for-mssp
docTags: 
createdAt: 2026-04-28T00:00:00.000Z
---

Use this guide to complete first-time AI SOC for MSSP deployment and verify data flow between one client tenant and one central tenant.

## Prerequisites

- You have administrative access to both client and central tenants.
- **AI SOC Core Solution** (26.2.0 or later) is available to install in each client tenant.
- Hero AI and base AI SOC capabilities are available in the client tenant.
- You can edit assets, webhooks, and playbook-related settings in both tenants.
- You have network access between client and central endpoints.
- You have a valid admin **PrivateToken** (personal access token) for central Swimlane API operations used by **AI SOC MSSP Central Sync**.
- You can create or copy a Swimlane PAT for the **client** **AI SOC Tenant Configuration** asset (**Private\_Token**). This is not the same token as **PrivateToken** on **AI SOC MSSP Central Sync**.
- After you install **AI SOC MSSP Client Extension**, disable **Enrich TIA Record** (Create) flow in the client **AI SOC Main** playbook. Do not disable the playbook itself. See **Disable Enrich TIA Record in AI SOC Main** in [Configure AI SOC for MSSP](docId\:AzfPz-c_qLu3ElVSZkLLw).

## Install in the Required Order

1. Install **AI SOC Core Solution** (26.2.0 or later) in the client tenant.
2. Install **AI SOC MSSP Client Extension** in the client tenant.
3. Install **AI SOC MSSP Central Solution** in the central tenant.
4. Confirm installation completion in each tenant before configuration.

### Accept Get Application Fields Schema overwrite

When you install **AI SOC MSSP Client Extension** in a tenant that already has **AI SOC Core Solution**, the installer may prompt to overwrite the **Get Application Fields Schema** component. Accept that overwrite. Do not skip or deselect this component. AI SOC Core does not use this component for client workflows. A later Core package will remove it.

## Configure AI SOC for MSSP

After installation, complete all configuration steps in [Configure AI SOC for MSSP](docId\:AzfPz-c_qLu3ElVSZkLLw):

1. Configure the client tenant (**AI SOC Tenant Configuration** PAT, include **TIA Central Sync Fields**, disable **Enrich TIA Record** (Create) flow in **AI SOC Main**, then MSSP sync assets).
2. Configure the central tenant (**Ingest Record from Client** webhook credentials). The webhook is required for Case Management and reporting sync.

## Validate First Data Flow

1. In the client tenant, ingest a test record through normal AI SOC ingestion.
2. Confirm the **Enrich TIA Record** (Create) flow is disabled in **AI SOC Main**. For an observable already present in central **Threat Intelligence Artifact Cache**, confirm client TIA enrichment does not run again.
3. In the central tenant, open **Central Case Management** and verify the client record appears.
4. Confirm **Client\_Name** from **AI SOC MSSP Client Configuration** is populated on the central case record.
5. Open **Threat Intelligence Artifact Cache** and verify the related TIAC record appears or updates (full TIAC record, not metadata only).
6. Open **Central SOC Reporting** or **Central SOC Reporting Workspace** and verify a reporting aggregate appears after the reporting job runs.

If validation fails, see [Validate and Troubleshoot MSSP Sync](docId\:QYEsknwk-RnSc1w1uax_D).

## Validation Sign-Off Checklist

- Configuration in [Configure AI SOC for MSSP](docId\:AzfPz-c_qLu3ElVSZkLLw) is complete for client and central tenants, including **TIA Central Sync Fields** and the **Enrich TIA Record** (Create) flow disabled in **AI SOC Main**.
- Client record is visible in central within your expected sync window.
- **Client\_Name** from **AI SOC MSSP Client Configuration** is populated on the central case record.
- TIAC updates are visible for at least one observable from the test record.
- A second update to the same client record propagates to central.
- A reporting aggregate is visible in **Central SOC Reporting** after the scheduled reporting sync.

## Expected Results

| Area                  | Expected Outcome                                                                                              |
| --------------------- | ------------------------------------------------------------------------------------------------------------- |
| Client workflow       | Record is created and updated normally in client **Case Management**                                          |
| Central visibility    | Related record is created or updated in **Central Case Management**                                           |
| TI cache              | Full TIAC record appears or updates in central **Threat Intelligence Artifact Cache**                         |
| Client TIA enrichment | **Enrich TIA Record** (Create) flow in **AI SOC Main** is disabled; cache hits do not re-enrich on the client |
| Reporting             | Aggregate records appear in **Central SOC Reporting** after the reporting job                                 |
| Client identity       | **Client\_Name** matches the client configuration asset                                                       |