--- title: Installing and Configuring AI SOC Solution slug: solutions/installing-and-configuring-ai-soc-solution docTags: createdAt: 2026-02-17T06:44:55.341Z --- This guide covers installing and configuring the AI SOC Solution. The AI SOC Solution is a complete bundle that includes all necessary components for AI-powered security operations. ## Install From the Content Library 1. Navigate to **Library** → **Swimlane Content** 2. Select **AI SOC Solution** and click **Install** 3. Keep all required content selected to avoid incomplete installs :::hint{type="info"} If you are prompted to overwrite content, deselect only items you do not want to replace. Removing required items can lead to missing functionality. ::: ## Verify Installation After installation, verify that all components are present: 1. **Applications:** Confirm the following applications exist: - **Case Management** (primary triage; package acronym CASE) - **Threat Intelligence** (may appear as **Threat Intelligence Artifact** in the UI) - **Signal Routing Rules** (may appear as **Routing Rule** in the UI) - **Knowledge Base Articles** (may appear as **KB Article** in the UI) - **AI Ingestion** (separate **AI Ingestion Workspace**; acronym **AI**) - **SOC Reporting** (**SOC Reporting Workspace**) - **ROI Calculator** (**ROI Calculator Workspace**) 2. **AI Features:** Open **Case Management** and verify: - The **AI Alert Analysis** panel is present - **Generate Plan** button is visible - Hero AI components are available 3. **Workspaces:** Verify the **AI SOC** workspace exists (it may be labeled **AI SOC** or **AI SOC Workspace** in your environment) and the **AI Ingestion Workspace** exists for ingestion tooling. 4. **Playbooks:** Check **Orchestration** → **Playbooks** to ensure ingestion and enrichment playbooks are installed 5. **Assets:** Check **Orchestration** → **Assets** and confirm tenant connectivity assets are present: - **AI SOC Tenant Configuration** (cookie-based Swimlane API access) - **Turbine Tenant Credentials** (personal access token–based API access) 6. **Custom configuration assets:** Confirm **AI SOC General Configuration**, **AI SOC Threat Intelligence Configuration**, and **AI SOC Correlation Configuration** are present. See [Configure Custom Assets](https://docs.swimlane.com/solutions/configure-custom-assets). 7. **Agentic investigation (optional):** If you use routing-rule agentic investigation, confirm **AI SOC - Trigger Analysis Agent via Routing Rule** exists in **Orchestration** → **Playbooks**. The package does **not** ship a pre-seeded **Signal Routing Rule**—create one after import. See [Getting Started — Enable Agentic Investigation After Import](https://docs.swimlane.com/solutions/getting-started#enable-agentic-investigation-after-import). ## Choose Your Ingestion Path Use this table to pick the right guide when you connect alert or email sources. Both paths produce Turbine Schema objects that downstream AI SOC playbooks consume. | **Your Situation** | **Use This Path** | **Guide** | | ---------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------ | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Packaged SIEM or XDR with an existing AI SOC template (webhook or cron) | Duplicate and configure an ingestion **template** playbook | [Configure Ingestion Playbooks — alert webhook and cron templates](https://docs.swimlane.com/solutions/configure-ingestion-playbooks) | | Reported phishing email from a mailbox (Graph, IMAP, and similar) | Configure the **phishing cron** template and email emit flow | [Configure Ingestion Playbooks — phishing cron template](https://docs.swimlane.com/solutions/configure-ingestion-playbooks) | | Net-new vendor API with OpenAPI spec; you need connector components and Turbine Schema mapping | Use the **AI Ingestion** widget to generate components and ingestion pipelines | [AI SOC Ingestion — AI Ingestion widget](https://docs.swimlane.com/solutions/ai-soc-ingestion) | | Lab or proof-of-concept before production routing | Test webhook or **Test CASE Generator** playbooks | [Configure Ingestion Playbooks — lab and test playbooks](https://docs.swimlane.com/solutions/configure-ingestion-playbooks) and [Integration Examples](https://docs.swimlane.com/solutions/integration-examples) | :::hint{type="info"} **AI Ingestion** supports **alert** ingestion only (not email ingestion). For phishing email, use ingestion template playbooks on the **Ingest\_Email** channel. See [Architecture and Data Flow](https://docs.swimlane.com/solutions/architecture-and-data-flow). ::: After ingestion is configured, alerts and emails flow through **Ingest\_Alert** or **Ingest\_Email** to **Case Management** records. For flow-level detail, see [Playbook Flow Reference](https://docs.swimlane.com/solutions/playbook-flow-reference). ## Configure Hero AI AI SOC requires Hero AI to be enabled for plan generation and verdict analysis. ### Verify Hero AI Status 1. Confirm Hero AI is enabled for your tenant 2. Verify Hero AI services are running and accessible 3. Test Hero AI connectivity if needed :::hint{type="info"} If Hero AI is disabled or unavailable, the **AI Alert Analysis** panel in **Case Management** will not generate plans or show AI output. Contact your administrator to enable Hero AI if AI features are missing. ::: ## Configure Assets Configure assets for the security tools and threat intelligence providers you will use. ### Threat Intelligence Providers Configure assets for threat intelligence providers such as: - VirusTotal - Recorded Future - Abuse.ch URLHaus - IPQualityScore - Other TI providers you use **Steps:** 1. Navigate to **Orchestration** → **Assets** 2. Create or configure assets for each TI provider 3. Enter API keys, tokens, or credentials as required 4. Save each asset; you can confirm it works when enrichment runs (for example, on a signal with observables). ### Security Tools Configure assets for security tools you will integrate: - SIEM platforms (for alert ingestion) - EDR/XDR platforms (for endpoint data) - Email security gateways (for phishing ingestion) - Identity providers (for user data) **Steps:** 1. Navigate to **Orchestration** → **Assets** 2. Create assets for each tool 3. Configure authentication (API keys, OAuth, and similar) 4. Verify the asset is saved; you can confirm it works when you use it in an ingestion playbook or other component. ## RBAC and Platform Permissions Analysts need appropriate **role-based access control (RBAC)** for **Case Management** widget options and for **Turbine components** (or **Orchestrator** access in **legacy RBAC**). Misaligned permissions can cause missing tools after **Generate Plan** (for example automation actions that do not list **AI SOC - CASE Hero AI Analysis**). See [RBAC Considerations for AI SOC](https://docs.swimlane.com/solutions/r8k2-rbac-considerations-for-ai-soc). ## Configuration Topics Complete these guides after install and asset setup: | **Topic** | **Guide** | | ------------------------------------------------------ | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Tenant connectivity and correlation assets | [Configure Custom Assets](https://docs.swimlane.com/solutions/configure-custom-assets) | | **Case Management** and TI field mappings | [Configure Custom Field Mappings](https://docs.swimlane.com/solutions/configure-custom-field-mappings) | | Ingestion template playbooks (webhook, cron, phishing) | [Configure Ingestion Playbooks](https://docs.swimlane.com/solutions/configure-ingestion-playbooks) | | Threat intelligence providers and enrichment | [Configure Threat Intelligence Enrichment](https://docs.swimlane.com/solutions/configure-threat-intelligence-enrichment) | | Agentic investigation via routing rules (post-import) | [Getting Started — Enable Agentic Investigation After Import](https://docs.swimlane.com/solutions/getting-started#enable-agentic-investigation-after-import), [Building Routing Rule Playbooks](https://docs.swimlane.com/solutions/building-routing-rule-playbooks) | | Swimlane Content, User Content, and Marketplace | [Swimlane Content, User Content, and Integrated Marketplace](https://docs.swimlane.com/solutions/swimlane-content-user-content-and-integrated-marketplace) | ## Next Steps | **If You Want To...** | **Go To** | | --------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------ | | Run your first investigation | [Getting Started](https://docs.swimlane.com/solutions/getting-started) | | Enable agentic investigation after import (routing rules) | [Getting Started — Enable Agentic Investigation After Import](https://docs.swimlane.com/solutions/getting-started#enable-agentic-investigation-after-import) | | Understand data flow and diagrams | [Architecture and Data Flow](https://docs.swimlane.com/solutions/architecture-and-data-flow) | | Build connectors with the AI Ingestion widget | [AI SOC Ingestion](https://docs.swimlane.com/solutions/ai-soc-ingestion) | | Map playbook flows after import | [Playbook Flow Reference](https://docs.swimlane.com/solutions/playbook-flow-reference) | | Set roles and permissions | [RBAC Considerations for AI SOC](https://docs.swimlane.com/solutions/r8k2-rbac-considerations-for-ai-soc) |