Operations and Guidance
This guide covers daily operational tasks, investigation workflows, and automation in AI SOC.
This page is for day-to-day analyst and operator work. For your first investigation, see Getting StartedGetting Started. For conceptual diagrams, see Architecture and Data FlowArchitecture and Data Flow. For flow-level playbook lookup (triggers, handoffs, troubleshooting), see Playbook Flow ReferencePlaybook Flow Reference.
Related Guides
Topic | Guide |
|---|---|
First signal investigation walkthrough | Getting StartedGetting Started |
Post-import agentic investigation (routing rules) | Getting Started β Enable Agentic Investigation After Import, Building Routing Rule PlaybooksBuilding Routing Rule Playbooks |
Playbook categories and when to use them | Playbook Types and UsagePlaybook Types and Usage |
Playbook flows, triggers, and handoffs | Playbook Flow ReferencePlaybook Flow Reference |
Build or attach routing rule playbooks | Building Routing Rule PlaybooksBuilding Routing Rule Playbooks |
Investigation plans and plan steps | Investigation Plan WorkflowInvestigation Plan Workflow |
How verdicts and confidence are set | Understanding Verdict GenerationUnderstanding Verdict Generation |
Automation from plans and rules | Creating AutomationCreating Automation |
End-to-end example investigation | Example Investigation WorkflowExample Investigation Workflow |
KB articles for plan generation | KB Article Best Practices for Plan GenerationKB Article Best Practices for Plan Generation |
Common Daily Tasks
These are the most frequent tasks you will perform when working with signals in AI SOC.
Claim a Signal
When to use: When you are starting to investigate a signal and want to assign it to yourself.
Steps:
- Open the record in Case Management
- In the Controls panel, click Claim
- Verify Current Owner updates to your user
Why it matters: Claiming signals prevents duplicate work and ensures clear ownership. Other analysts can see you are working on it.
Change the Manual Verdict
When to use: After completing your investigation, set the verdict to reflect your findings.
Steps:
- Open the signal record
- In the Triage panel, open Manual Verdict
- Select the appropriate verdict:
- Malicious: Confirmed threat requiring response
- Suspicious: Needs further investigation
- Benign: False positive, no threat
- Unknown: Insufficient data to determine
- Save the record
Why it matters: Manual verdicts improve AI learning and provide historical context for similar signals.
Run Investigation Plan Steps
When to use: Execute investigation steps from an AI-generated plan, or review results after on-record Re-investigate or a Trigger Analysis Agent routing run (on the record or from a routing rule).
Manual plan execution:
- Ensure a plan has been generated (click Generate Plan if needed)
- Navigate to the appropriate phase (Preparation, Analysis, or Determination)
- For a single step: Click Run on the specific step
- For all steps in a phase: Click Run All Steps
- Review results in the step timeline
- Add notes if you modify or skip steps
Agentic investigation on the record:
- Set Analysis Mode to Autonomous on Case Analysis (case metadata column) or Support
- In AI Alert Analysis, click Re-investigate to start agentic investigation (which invokes AI SOC - Trigger Analysis Agent)
- Follow the Agent Investigation panelβthe agent summarizes the case, uses TI observables, searches and runs tenant components, and reports step completion until the status badge shows Complete
- Review component inputs, outputs, session summary, and verdict in Signal Summary
- To run again after material changes, click Re-investigate, update linked Knowledge Base Articles first if needed, and confirm the dialog (re-investigating removes current agent progress and resets the verdict; changes cannot be reverted)
Agentic investigation via routing rules: When a Signal Routing Rule runs AI SOC - Trigger Analysis Agent via Routing Rule, the packaged playbook invokes the Analysis agent on the matched record. Investigation may complete before an analyst opens the record. Review the Rules area on the signal to see which rule ran, then review plan and verdict fields as you would after AI assisted investigation. See Building Routing Rule PlaybooksBuilding Routing Rule Playbooks.
Available actions (manual plans):
- Run: Execute a single step
- Run All Steps: Execute all steps in the selected phase sequentially
- Review: Inspect what a step will do before running it
- Mark as Done: Mark a step as completed (if done manually outside the system)
- Mark as Open: Reopen a completed step to run it again
- Delete Step: Remove a step from the plan
- Add Additional Step: Insert a custom step into the plan
- Regenerate Investigation Plan: Refresh the plan when evidence or KBAs change β see Investigation Plan WorkflowInvestigation Plan Workflow
Tips:
- Steps showing Install need integrations to be installed first
- Review steps before running, especially those that modify systems
- Document any deviations from the AI plan
- Only components marked Visible to Hero AI are available to the AI SOC - Trigger Analysis Agent
Escalated Status and Sustained Investigation
AI SOC centers on Case Management records (prefix CASE-). When AI verdict and confidence meet thresholds your administrator configured, pending CASE resolution (and related playbooks) may set Status to Escalated and drive prioritization and metrics. Analysts continue investigation on the same record unless your organization uses a separate linked record pattern.
Sustained investigation: Use Claim, In Progress, investigation comments, evidence, and routing rules as needed. To change when records become Escalated or Closed, administrators edit the pending CASE resolution flow in Orchestration β Playbooks.
Add a Knowledge Base Article
When to use: Document organization context, vendor platforms, detection rules, single-alert runbooks, or false positive patterns.
Steps: Follow Knowledge Base Articles (KB)How to Create KB Articles in Knowledge Base Articles (KB)Knowledge Base Articles (KB). Summary:
- Application Records β Knowledge Base Articles β Add.
- Set Record Type to Case Management, Category (for example Best Practices), and Scope (Global, Signal Source, Signal Rule, or Signal Name).
- Set Matching Value to the exact source, rule, or signal nameβor leave empty for Global.
- Complete Context Summary and Guidance; turn Enabled on; Save.
Best practices:
- Match Scope to the narrowest fit (see scope table in the KB guide).
- Name installed connectors and playbooks in Guidance so Generate Plan and agentic investigation suggest tenant-ready steps.
- See KB Article Best Practices for Plan GenerationKB Article Best Practices for Plan Generation.
Reanalyze a Signal
When to use: After major evidence changes (new observables, completed enrichment, investigation findings).
Steps:
- Open the signal record
- In the AI Alert Analysis panel, click Reanalyze
- Hero AI re-runs the verdict analysis with updated context
- Review the updated verdict, confidence, and analysis
Why it matters: Reanalysis ensures verdicts stay current as new evidence is discovered.
Review Correlation Results
When to use: Before starting a new investigation to avoid duplicate work.
Steps:
- Open the signal record
- Check the Correlation panel
- Review similar signals and related cases
- If similar signals exist:
- Check how they were resolved
- Review investigation notes
- Determine if this is a duplicate or related incident
Why it matters: Correlation helps identify related activity and prevents duplicate investigations.
Automated Signal Resolution
After a signal leaves Processing, a flow (pending signal resolution) automatically sets the signal's status based on the AI verdict and confidence:
- Escalated: If AI verdict confidence meets the configured threshold (for example, β₯ 8) and the verdict is Malicious or Suspicious, the pending resolution flow may set the record to Escalated (wording and thresholds depend on your installed playbooks).
- Auto-close: If confidence meets the threshold and the verdict is Benign, the signal is closed.
- New: Otherwise (for example, verdict not yet defined), the signal is set to New for analyst review.
Classification (True Positive, False Positive, Unknown) is also set in this flow. To change escalation or auto-close thresholds (for example, confidence level), administrators edit the pending signal resolution flow in Orchestration β Playbooks; this logic is not configured via assets. See Installation and Configuration for where configuration lives.