Installing and Configuring AI SOC Solution
This guide covers installing and configuring the AI SOC Solution. The AI SOC Solution is a complete bundle that includes all necessary components for AI-powered security operations.
Install From the Content Library
- Navigate to Library β Swimlane Content
- Select AI SOC Solution and click Install
- Keep all required content selected to avoid incomplete installs
If you are prompted to overwrite content, deselect only items you do not want to replace. Removing required items can lead to missing functionality.
Verify Installation
After installation, verify that all components are present:
- Applications: Confirm the following applications exist:
- Case Management (primary triage; package acronym CASE)
- Threat Intelligence (may appear as Threat Intelligence Artifact in the UI)
- Signal Routing Rules (may appear as Routing Rule in the UI)
- Knowledge Base Articles (may appear as KB Article in the UI)
- AI Ingestion (separate AI Ingestion Workspace; acronym AI)
- SOC Reporting (SOC Reporting Workspace)
- ROI Calculator (ROI Calculator Workspace)
- AI Features: Open Case Management and verify:
- The AI Alert Analysis panel is present
- Generate Plan button is visible
- Hero AI components are available
- Workspaces: Verify the AI SOC workspace exists (it may be labeled AI SOC or AI SOC Workspace in your environment) and the AI Ingestion Workspace exists for ingestion tooling.
- Playbooks: Check Orchestration β Playbooks to ensure ingestion and enrichment playbooks are installed
- Assets: Check Orchestration β Assets and confirm tenant connectivity assets are present:
- AI SOC Tenant Configuration (cookie-based Swimlane API access)
- Turbine Tenant Credentials (personal access tokenβbased API access)
- Custom configuration assets: Confirm AI SOC General Configuration, AI SOC Threat Intelligence Configuration, and AI SOC Correlation Configuration are present. See Configure Custom Assets.
- Agentic investigation (optional): If you use routing-rule agentic investigation, confirm AI SOC - Trigger Analysis Agent via Routing Rule exists in Orchestration β Playbooks. The package does not ship a pre-seeded Signal Routing Ruleβcreate one after import. See Getting Started β Enable Agentic Investigation After Import.
Choose Your Ingestion Path
Use this table to pick the right guide when you connect alert or email sources. Both paths produce Turbine Schema objects that downstream AI SOC playbooks consume.
Your Situation | Use This Path | Guide |
|---|---|---|
Packaged SIEM or XDR with an existing AI SOC template (webhook or cron) | Duplicate and configure an ingestion template playbook | |
Reported phishing email from a mailbox (Graph, IMAP, and similar) | Configure the phishing cron template and email emit flow | |
Net-new vendor API with OpenAPI spec; you need connector components and Turbine Schema mapping | Use the AI Ingestion widget to generate components and ingestion pipelines | |
Lab or proof-of-concept before production routing | Test webhook or Test CASE Generator playbooks |
AI Ingestion supports alert ingestion only (not email ingestion). For phishing email, use ingestion template playbooks on the Ingest_Email channel. See Architecture and Data Flow.
After ingestion is configured, alerts and emails flow through Ingest_Alert or Ingest_Email to Case Management records. For flow-level detail, see Playbook Flow Reference.
Configure Hero AI
AI SOC requires Hero AI to be enabled for plan generation and verdict analysis.
Verify Hero AI Status
- Confirm Hero AI is enabled for your tenant
- Verify Hero AI services are running and accessible
- Test Hero AI connectivity if needed
If Hero AI is disabled or unavailable, the AI Alert Analysis panel in Case Management will not generate plans or show AI output. Contact your administrator to enable Hero AI if AI features are missing.
Configure Assets
Configure assets for the security tools and threat intelligence providers you will use.
Threat Intelligence Providers
Configure assets for threat intelligence providers such as:
- VirusTotal
- Recorded Future
- Abuse.ch URLHaus
- IPQualityScore
- Other TI providers you use
Steps:
- Navigate to Orchestration β Assets
- Create or configure assets for each TI provider
- Enter API keys, tokens, or credentials as required
- Save each asset; you can confirm it works when enrichment runs (for example, on a signal with observables).
Security Tools
Configure assets for security tools you will integrate:
- SIEM platforms (for alert ingestion)
- EDR/XDR platforms (for endpoint data)
- Email security gateways (for phishing ingestion)
- Identity providers (for user data)
Steps:
- Navigate to Orchestration β Assets
- Create assets for each tool
- Configure authentication (API keys, OAuth, and similar)
- Verify the asset is saved; you can confirm it works when you use it in an ingestion playbook or other component.
RBAC and Platform Permissions
Analysts need appropriate role-based access control (RBAC) for Case Management widget options and for Turbine components (or Orchestrator access in legacy RBAC). Misaligned permissions can cause missing tools after Generate Plan (for example automation actions that do not list AI SOC - CASE Hero AI Analysis). See RBAC Considerations for AI SOC.
Configuration Topics
Complete these guides after install and asset setup:
Topic | Guide |
|---|---|
Tenant connectivity and correlation assets | |
Case Management and TI field mappings | |
Ingestion template playbooks (webhook, cron, phishing) | |
Threat intelligence providers and enrichment | |
Agentic investigation via routing rules (post-import) | |
Swimlane Content, User Content, and Marketplace |
Next Steps
If You Want To... | Go To |
|---|---|
Run your first investigation | |
Enable agentic investigation after import (routing rules) | |
Understand data flow and diagrams | |
Build connectors with the AI Ingestion widget | |
Map playbook flows after import | |
Set roles and permissions |