Integration Examples

This guide provides step-by-step examples for integrating common security tools with AI SOC. Each example includes configuration steps and troubleshooting tips.

Splunk Integration

Splunk is a common SIEM platform used for security monitoring and alerting. Integrate Splunk with AI SOC to automatically ingest security alerts and create signals.

Integration Methods

Method 1: Webhook Ingestion (Recommended)

Use Splunk's webhook capabilities to send alerts directly to AI SOC in real-time.

Step 1: Configure Splunk Alert Action

In Splunk, create or edit a saved search that generates security alerts

Add a webhook alert action:

URL: Your AI SOC webhook endpoint URL

HTTP Method: POST

Authentication: Include API key or token in headers if required

Step 2: Configure AI SOC Ingestion Playbook

Navigate to Orchestration → Playbooks

Open SOC - Alert Ingestion (Webhook) - Template

Configure the Placeholder - Create TEDS Alert (Webhook) action:

Map Splunk fields to TEDS format

Ensure observable extraction is configured

Configure Custom Alert Data Extension (Webhook):

Map Splunk-specific fields to Signal fields

Preserve raw alert data for investigation

Step 3: Test Integration

Trigger a test alert in Splunk

Verify the alert appears in Case Management

Check that observables are extracted correctly

Verify threat intelligence enrichment runs automatically

Method 2: Bulk Ingestion (CRON)

Use scheduled searches to pull alerts in bulk on a regular interval.

Step 1: Configure Splunk Scheduled Search

Create a saved search that returns security alerts

Schedule the search to run every 5-15 minutes

Configure the search to output results in a format AI SOC can consume

Step 2: Configure AI SOC Bulk Ingestion Playbook

Navigate to Orchestration → Playbooks

Open SOC - Alert Ingestion (Cron) - Template

Configure Placeholder - Create TEDS Alert List:

Set up API connection to Splunk

Configure authentication (API token or credentials)

Map Splunk search results to alert format

Configure CRON schedule to match Splunk search schedule

Step 3: Configure Splunk API Access

In Splunk, create an API token or app with appropriate permissions

Configure the token in AI SOC assets:

Navigate to Orchestration → Assets

Create or update Splunk asset with API credentials

Test connection

Troubleshooting:

Alerts not appearing: Check webhook URL, authentication, and playbook enablement

Observables not extracted: Verify field mappings in playbook configuration

Authentication errors: Verify API token permissions and expiration

CrowdStrike Integration

CrowdStrike Falcon is an EDR/XDR platform. Integrate CrowdStrike to ingest detection alerts and enrich signals with endpoint data.

Integration Methods

Method 1: Webhook Ingestion

Use CrowdStrike's Stream API or webhook capabilities to send detection alerts to AI SOC.

Step 1: Configure CrowdStrike Stream API

In CrowdStrike Falcon Console, navigate to Support → API Clients and Keys

Create a new API client with Detection Read and Host Read permissions

Note the Client ID and Client Secret

Step 2: Set Up Detection Stream

Use CrowdStrike's Stream API to subscribe to detection events

Configure a webhook endpoint that receives detection alerts:

URL: Your AI SOC webhook endpoint URL

Format: JSON

Step 3: Configure AI SOC Ingestion Playbook

Navigate to Orchestration → Playbooks

Open SOC - Alert Ingestion (Webhook) - Template

Configure field mappings:

Map host information to source IP observable

Map process information to file hash observable

Map MITRE ATT&CK techniques

Map severity to signal severity

Step 4: Configure CrowdStrike Asset

Navigate to Orchestration → Assets

Create CrowdStrike asset:

Base URL: CrowdStrike API URL

Client ID: Your CrowdStrike API client ID

Client Secret: Your CrowdStrike API client secret

Test connection

Method 2: Using CrowdStrike Connector in Investigation Plans

Use CrowdStrike connector actions in investigation plans to query endpoint data.

Step 1: Install CrowdStrike Connector

Navigate to Library → Swimlane Content

Search for "CrowdStrike" connector

Install the connector

Step 2: Configure Connector Asset

Navigate to Orchestration → Assets

Configure CrowdStrike asset with API credentials

Test connection

Step 3: Use in Investigation Plans When generating investigation plans, Hero AI will suggest CrowdStrike actions such as:

Get endpoint details

List detections for host

Search for processes connecting to IP

Get process details

Troubleshooting:

Authentication errors: Verify API client permissions and token expiration

Missing endpoint data: Check that host is visible in CrowdStrike console

Timeout errors: Verify network connectivity and API rate limits

Threat Intelligence Provider Integration

Integrate threat intelligence providers to enrich observables automatically.

VirusTotal Integration

Step 1: Obtain API Key

Navigate to API Key section

Copy your API key

Step 2: Configure Asset

Navigate to Orchestration → Assets

Create VirusTotal asset:

API Key: Your VirusTotal API key

Base URL: VirusTotal API URL

Test connection

Step 3: Configure Enrichment Playbook

Open SOC - Enrich Observables playbook

Ensure VirusTotal enrichment action is included

Configure as primary provider for file hashes (optional)

Recorded Future Integration

Step 1: Obtain API Credentials

In Recorded Future, navigate to Settings → API

Create API token

Note token and API URL

Step 2: Configure Asset

Navigate to Orchestration → Assets

Create Recorded Future asset:

API Token: Your Recorded Future token

Base URL: Your Recorded Future API URL

Test connection

Step 3: Configure as Primary Provider

Navigate to Orchestration → Assets

Configure TI Primary Intelligence Providers asset:

Set Recorded Future as primary for IPs and domains

Configure enrichment playbook to use primary providers

General Integration Best Practices

Webhook Configuration

Security:

Use HTTPS for all webhook endpoints

Implement authentication (API keys, tokens, or signatures)

Validate webhook payloads before processing

Rate limit webhook endpoints to prevent abuse

Reliability:

Implement retry logic for failed webhook deliveries

Log all webhook receipts for audit purposes

Monitor webhook endpoint health

Set up alerts for webhook failures

Field Mapping

Standardization:

Map vendor-specific fields to standardized Signal fields

Preserve raw alert data in custom fields for investigation

Extract observables consistently across integrations

Map severity levels to AI SOC severity scale

Observable Extraction:

Configure playbooks to extract all observable types (IPs, domains, hashes, URLs)

Validate observable formats before enrichment

Handle multiple observables per alert

Support nested observables in complex alert structures

Testing

Test Scenarios:

Send test alert from source system

Verify signal creation in AI SOC

Check observable extraction

Verify threat intelligence enrichment

Test investigation plan generation

Validate field mappings

Common Issues:

Missing observables: Check extraction logic in playbook

Field mapping errors: Review field mappings and data types

Authentication failures: Verify credentials and permissions

Timeout errors: Check network connectivity and API rate limits

Installing and Configuring AI SOC Solution - Initial setup and configuration

Operations and Guidance - Daily operational tasks

Troubleshooting - Common integration issues

Integration Examples

Splunk Integration

Integration Methods

CrowdStrike Integration

Integration Methods

Threat Intelligence Provider Integration

VirusTotal Integration

Recorded Future Integration

General Integration Best Practices

Webhook Configuration

Field Mapping

Testing

Related Documentation