Knowledge Base Articles (KB)

Knowledge Base Articles (application KB Article) store institutional investigation guidance. Hero AI uses linked articles for Generate Plan, investigation steps, and verdict context. Create articles with the right Scope so each record applies only where it should.

Choose Your Path

If You Want To...	Go To
Create a new KB article (UI steps)	How to Create KB Articles
Decide Global versus source versus alert content	Types of KB Articles
Understand Scope and Matching Value	Scope: How Articles Match Cases
Format Guidance for plan generation	KB Article Best Practices for Plan GenerationKB Article Best Practices for Plan Generation
Field reference	Record Fields
Copy-paste examples	Examples by Scope

How to Create KB Articles

Use this workflow whenever you add or update a KB Article record in the tenant.

Open the KB Application

Navigate to Application Records → Knowledge Base Articles.

Click Add to open New Record on the Article tab.

Choose Scope Before You Write

Pick the narrowest scope that fits your content. Do not put a single-alert runbook in Global, and do not put organization-wide tool lists in Signal Name.

If your content is...	Set Scope to	Matching Value
Organization tools, policies, whitelists, classification rules for all alerts	Global	Leave empty (not required for global KB articles)
Default triage for one vendor or platform (all alerts from that source)	Signal Source	Exact Signal Source on the case (case-sensitive)
Steps for one detection rule that covers several alert titles	Signal Rule	Exact rule name or ID on the case
Full procedure for one alert title only	Signal Name	Exact Signal Name / alert name on the case

See Types of KB Articles for what to write in Guidance for each type.

Complete Required Fields

Turn Enabled on when the article should be active.

Enter Title (required). Use a name that reflects scope (for example Organization environment and tooling or JumpCloud login failure detected).

Set Record Type to Case Management for AI SOC triage and Generate Plan.

Select Category (required): Industry Frameworks, Best Practices, or Memos.

Select Scope and Matching Value per the table above.

Enter Context Summary (recommended): one or two sentences on when this article applies.

Enter Guidance in the rich text editor: scope-appropriate content and investigation steps (see KB Article Best Practices for Plan GenerationKB Article Best Practices for Plan Generation).

Set Read Only only if the record must not be edited.

Click Save.

For non-global articles, Matching Value must match the case field exactly. If Scope is Signal Source but the value does not match the case Signal Source, the article does not auto-link and Hero AI may not use it for that alert.

Verify the Article Works

This verification applies to new case records (for example a newly ingested test alert). Auto-linking and Generate Plan behavior may not reflect KB changes on cases that were created before the article was saved or updated.

Ingest a test alert or open a new Case Management case that should match the article.

Confirm the article appears under Knowledge Base on the case when scope and matching are correct.

Run Generate Plan and confirm steps reflect your Guidance and installed connectors.

Types of KB Articles

Good KB articles are scoped, operational, and non-duplicative: organization facts stay global, vendor behavior stays at Signal Source, and single-alert triage stays at Signal Name or Signal Rule.

Type (authoring model)	Scope in the UI	What to include in Guidance	Do not include
Global	Global	Customer or tenant environment/tools: IdP, EDR, SIEM, ticketing; Swimlane connectors you use; default lookback (for example 24 hours, extend to seven days when findings are suspicious); approved domains, scanners, and break-glass notes; organization-wide classification principles (for example do not mark Malicious from threat intelligence alone without corroborating case evidence)	Steps for one alert title; full vendor-only runbooks (use Signal Source)
Source-specific	Signal Source	What the product is; reliable and noisy fields; where to investigate in the console or SIEM; entity mapping (user, host, IP, process, hash); recommended enrichment order and Turbine components; common false positives for that source	Entire org tool list (use Global); login-failure-only logic for one title (use Signal Name)
Rule-specific	Signal Rule	Procedures shared by alerts from the same detection rule (several alert names under one rule)	Org-wide policies (use Global); one-off alert title detail (use Signal Name)
Alert-specific	Signal Name	What this alert usually means in your environment; numbered investigation steps; evidence to collect; If [condition], then classify as [verdict] rules (Benign, Suspicious, Malicious, Unknown); remediation when required	CrowdStrike-wide or Okta-wide steps (use Signal Source); org facts (use Global)

Do not bloat Global. If your organization has hundreds of alert types, a single Global article cannot list login-failure logic, EDR process chains, and cloud exfiltration steps for each. Split content by Signal Source, Signal Rule, or Signal Name.

Scope: How Articles Match Cases

On the KB record, Scope defines which case field is compared to Matching Value.

Scope (UI)	Applies when	Matching Value
Global	Organization-wide context for all cases	Leave empty
Signal Source	Any alert from one platform or integration	Exact Signal Source string (for example CrowdStrike)
Signal Rule	Alerts from one detection rule	Exact rule identifier or name on the case
Signal Name	One specific alert title only	Exact Signal Name / alert name

Record Fields

Field	Required	Purpose
Title	Yes	Human-friendly name.
Record Type	Yes	Use Case Management for AI SOC and Generate Plan.
Category	Yes	Industry Frameworks, Best Practices, or Memos.
Scope	Yes	Global, Signal Source, Signal Rule, or Signal Name.
Matching Value	Depends on Scope	Matched value on the case; empty for Global.
Context Summary	Recommended	When the article applies.
Guidance	Recommended	Procedures and classification rules ( Article tab).
Enabled	—	Article is active when on.
Read Only	—	Optional lock against edits.

The Article tab shows audit fields after save. History and Support tabs are available on saved records.

What to Include in Guidance

Topic	Why it matters
Security control or platform role	Helps Hero AI interpret alert context.
Use within Swimlane	Connectors, components, and playbooks installed in your tenant.
Investigation steps	Phase-based, one action per line, explicit product names.
Key data points	Case or alert fields used for lookups.
Whitelists and blocklists	Approved assets, domains, scanners, or patterns to treat as benign.
Classification principles	Clear If [condition], then classify as [verdict] statements.

Reference only integrations installed in your tenant so plan generation does not suggest unavailable components.

Examples by Scope

Global — Organization Environment

Field	Example value
Title	Organization standards and tooling
Category	Best Practices
Scope	Global
Matching Value	(empty)
Guidance	JumpCloud for identity, CrowdStrike for endpoint, Elastic for SIEM, Jira for ticketing; use CrowdStrike components for hosts and JumpCloud for users; 24-hour lookback, seven days when suspicious; approved domains and internal scanners; do not classify Malicious from VirusTotal alone.

Signal Source — CrowdStrike Endpoint Security

Field	Example value
Title	CrowdStrike endpoint security triage
Category	Best Practices
Scope	Signal Source
Matching Value	CrowdStrike
Context Summary	CrowdStrike is our endpoint platform; default steps for all CrowdStrike-sourced cases.
Guidance	Enrichment order, Falcon queries, entity mapping, common false positives, containment components.

Field	Example value
Title	JumpCloud login failure detected
Category	Best Practices
Scope	Signal Name
Matching Value	JumpCloud login failure detected
Guidance	Compare login IP to usual ISP and working hours; if four or more consecutive failures or region differs from usual, favor Malicious; otherwise consider typo or benign.

Linking and Plan Generation

Auto-link: When Scope and Matching Value match case fields, the article can link automatically.

Manual link: Attach articles on the Case Management record during triage.

Generate Plan: Hero AI uses linked and matched Context Summary and Guidance when building investigation steps.

Next Steps

Topic	Guide
Guidance format and phases	KB Article Best Practices for Plan GenerationKB Article Best Practices for Plan Generation
Add articles in daily workflows	Operations and GuidanceOperations and Guidance
Investigation plan phases	Investigation Plan WorkflowInvestigation Plan Workflow