Integrate with the AI SOC Pipeline
After you create an ingestion component, use it in the broader AI SOC pipeline. A typical flow looks like this:
- The AI Ingestion component fetches raw alerts from the vendor and outputs a TEDS object.
- The AI SOC Alert Ingestion playbook receives the TEDS object and runs deduplication, enrichment, and correlation.
- Case Management receives CASE records for analyst triage and investigation.
For guidance on integrating with the playbooks (webhook and cron alert ingestion templates), see Configure Ingestion PlaybooksConfigure Ingestion Playbooks.