---
title: Integration Examples
slug: solutions/integration-examples
docTags: 
createdAt: 2026-02-24T08:23:12.333Z
---

This guide provides step-by-step examples for integrating common security tools with AI SOC. Each example includes configuration steps and troubleshooting tips.

***

## Splunk Integration

Splunk is a common SIEM platform used for security monitoring and alerting. Integrate Splunk with AI SOC to automatically ingest security alerts and create signals.

### Integration Methods

**Method 1: Webhook Ingestion (Recommended)**

Use Splunk's webhook capabilities to send alerts directly to AI SOC in real-time.

**Step 1: Configure Splunk Alert Action**

1. In Splunk, create or edit a saved search that generates security alerts
2. Add a webhook alert action:
   - **URL:** Your AI SOC webhook endpoint URL
   - **HTTP Method:** POST
   - **Authentication:** Include API key or token in headers if required

**Step 2: Configure AI SOC Ingestion Playbook**

1. Navigate to **Orchestration** → **Playbooks**
2. Open **SOC - Alert Ingestion (Webhook) - Template**
3. Configure the **Placeholder - Create TEDS Alert (Webhook)** action:
   - Map Splunk fields to TEDS format
   - Ensure observable extraction is configured
4. Configure **Custom Alert Data Extension (Webhook)**:
   - Map Splunk-specific fields to Signal fields
   - Preserve raw alert data for investigation

**Step 3: Test Integration**

1. Trigger a test alert in Splunk
2. Verify the alert appears in **Case Management**
3. Check that observables are extracted correctly
4. Verify threat intelligence enrichment runs automatically

**Method 2: Bulk Ingestion (CRON)**

Use scheduled searches to pull alerts in bulk on a regular interval.

**Step 1: Configure Splunk Scheduled Search**

1. Create a saved search that returns security alerts
2. Schedule the search to run every 5-15 minutes
3. Configure the search to output results in a format AI SOC can consume

**Step 2: Configure AI SOC Bulk Ingestion Playbook**

1. Navigate to **Orchestration** → **Playbooks**
2. Open **SOC - Alert Ingestion (Cron) - Template**
3. Configure **Placeholder - Create TEDS Alert List**:
   - Set up API connection to Splunk
   - Configure authentication (API token or credentials)
   - Map Splunk search results to alert format
4. Configure CRON schedule to match Splunk search schedule

**Step 3: Configure Splunk API Access**

1. In Splunk, create an API token or app with appropriate permissions
2. Configure the token in AI SOC assets:
   - Navigate to **Orchestration** → **Assets**
   - Create or update Splunk asset with API credentials
   - Test connection

**Troubleshooting:**

- **Alerts not appearing:** Check webhook URL, authentication, and playbook enablement
- **Observables not extracted:** Verify field mappings in playbook configuration
- **Authentication errors:** Verify API token permissions and expiration

***

## CrowdStrike Integration

CrowdStrike Falcon is an EDR/XDR platform. Integrate CrowdStrike to ingest detection alerts and enrich signals with endpoint data.

### Integration Methods

**Method 1: Webhook Ingestion**

Use CrowdStrike's Stream API or webhook capabilities to send detection alerts to AI SOC.

**Step 1: Configure CrowdStrike Stream API**

1. In CrowdStrike Falcon Console, navigate to **Support** → **API Clients and Keys**
2. Create a new API client with **Detection Read** and **Host Read** permissions
3. Note the Client ID and Client Secret

**Step 2: Set Up Detection Stream**

1. Use CrowdStrike's Stream API to subscribe to detection events
2. Configure a webhook endpoint that receives detection alerts:
   - **URL:** Your AI SOC webhook endpoint URL
   - **Format:** JSON

**Step 3: Configure AI SOC Ingestion Playbook**

1. Navigate to **Orchestration** → **Playbooks**
2. Open **SOC - Alert Ingestion (Webhook) - Template**
3. Configure field mappings:
   - Map host information to source IP observable
   - Map process information to file hash observable
   - Map MITRE ATT\&CK techniques
   - Map severity to signal severity

**Step 4: Configure CrowdStrike Asset**

1. Navigate to **Orchestration** → **Assets**
2. Create CrowdStrike asset:
   - **Base URL:** CrowdStrike API URL
   - **Client ID:** Your CrowdStrike API client ID
   - **Client Secret:** Your CrowdStrike API client secret
3. Test connection

**Method 2: Using CrowdStrike Connector in Investigation Plans**

Use CrowdStrike connector actions in investigation plans to query endpoint data.

**Step 1: Install CrowdStrike Connector**

1. Navigate to **Library** → **Swimlane Content**
2. Search for "CrowdStrike" connector
3. Install the connector

**Step 2: Configure Connector Asset**

1. Navigate to **Orchestration** → **Assets**
2. Configure CrowdStrike asset with API credentials
3. Test connection

**Step 3: Use in Investigation Plans**
When generating investigation plans, Hero AI will suggest CrowdStrike actions such as:

- Get endpoint details
- List detections for host
- Search for processes connecting to IP
- Get process details

**Troubleshooting:**

- **Authentication errors:** Verify API client permissions and token expiration
- **Missing endpoint data:** Check that host is visible in CrowdStrike console
- **Timeout errors:** Verify network connectivity and API rate limits

***

## Threat Intelligence Provider Integration

Integrate threat intelligence providers to enrich observables automatically.

### VirusTotal Integration

**Step 1: Obtain API Key**

1. Sign up for VirusTotal account
2. Navigate to **API Key** section
3. Copy your API key

**Step 2: Configure Asset**

1. Navigate to **Orchestration** → **Assets**
2. Create VirusTotal asset:
   - **API Key:** Your VirusTotal API key
   - **Base URL:** VirusTotal API URL
3. Test connection

**Step 3: Configure Enrichment Playbook**

1. Open **SOC - Enrich Observables** playbook
2. Ensure VirusTotal enrichment action is included
3. Configure as primary provider for file hashes (optional)

### Recorded Future Integration

**Step 1: Obtain API Credentials**

1. In Recorded Future, navigate to **Settings** → **API**
2. Create API token
3. Note token and API URL

**Step 2: Configure Asset**

1. Navigate to **Orchestration** → **Assets**
2. Create Recorded Future asset:
   - **API Token:** Your Recorded Future token
   - **Base URL:** Your Recorded Future API URL
3. Test connection

**Step 3: Configure as Primary Provider**

1. Navigate to **Orchestration** → **Assets**
2. Configure **TI Primary Intelligence Providers** asset:
   - Set Recorded Future as primary for IPs and domains
3. Configure enrichment playbook to use primary providers

***

## General Integration Best Practices

### Webhook Configuration

**Security:**

- Use HTTPS for all webhook endpoints
- Implement authentication (API keys, tokens, or signatures)
- Validate webhook payloads before processing
- Rate limit webhook endpoints to prevent abuse

**Reliability:**

- Implement retry logic for failed webhook deliveries
- Log all webhook receipts for audit purposes
- Monitor webhook endpoint health
- Set up alerts for webhook failures

### Field Mapping

**Standardization:**

- Map vendor-specific fields to standardized Signal fields
- Preserve raw alert data in custom fields for investigation
- Extract observables consistently across integrations
- Map severity levels to AI SOC severity scale

**Observable Extraction:**

- Configure playbooks to extract all observable types (IPs, domains, hashes, URLs)
- Validate observable formats before enrichment
- Handle multiple observables per alert
- Support nested observables in complex alert structures

### Testing

**Test Scenarios:**

1. Send test alert from source system
2. Verify signal creation in AI SOC
3. Check observable extraction
4. Verify threat intelligence enrichment
5. Test investigation plan generation
6. Validate field mappings

**Common Issues:**

- **Missing observables:** Check extraction logic in playbook
- **Field mapping errors:** Review field mappings and data types
- **Authentication failures:** Verify credentials and permissions
- **Timeout errors:** Check network connectivity and API rate limits

***

## Related Documentation

- [Installing and Configuring AI SOC Solution](docId:_b7njxu5XnzYrjCnGQg5J) - Initial setup and configuration
- [Operations and Guidance](docId\:DsdGtAQeg95DSeAF2Iat-) - Daily operational tasks
- [Troubleshooting](docId\:cKnuXQV85k9lu0OCqV218) - Common integration issues