--- title: Operations and Guidance slug: solutions/operations-and-guidance docTags: createdAt: 2026-02-17T06:44:55.445Z --- This guide covers daily operational tasks, investigation workflows, and automation in AI SOC. :::hint{type="info"} This page is for **day-to-day analyst and operator work**. For your first investigation, see [Getting Started](docId\:p7QJQUayeKczHPxEpPWcp). For conceptual diagrams, see [Architecture and Data Flow](docId\:kWCIabPwqOzQcjd2eZtic). For flow-level playbook lookup (triggers, handoffs, troubleshooting), see [Playbook Flow Reference](docId\:ZLfIPKIHFJKNqGcHW7Sxb). ::: ## Related Guides | Topic | Guide | | ------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | First signal investigation walkthrough | [Getting Started](docId\:p7QJQUayeKczHPxEpPWcp) | | Post-import agentic investigation (routing rules) | [Getting Started — Enable Agentic Investigation After Import](https://docs.swimlane.com/solutions/getting-started#enable-agentic-investigation-after-import), [Building Routing Rule Playbooks](docId\:vEiFYG4oYWkQ3DcMMwjXi) | | Playbook categories and when to use them | [Playbook Types and Usage](docId\:Np4vvQLU6pnRWzSbEL_EO) | | Playbook flows, triggers, and handoffs | [Playbook Flow Reference](docId\:ZLfIPKIHFJKNqGcHW7Sxb) | | Build or attach routing rule playbooks | [Building Routing Rule Playbooks](docId\:vEiFYG4oYWkQ3DcMMwjXi) | | Investigation plans and plan steps | [Investigation Plan Workflow](docId\:BdE8P71Mmp2LByMuZuOOI) | | How verdicts and confidence are set | [Understanding Verdict Generation](docId\:bnyC263YSL2bmAJhBaIOb) | | Automation from plans and rules | [Creating Automation](docId\:wJpjTO3fjnO0JiO1DYV3S) | | End-to-end example investigation | [Example Investigation Workflow](docId\:Uy5On2guVxAzzhRJc99wx) | | KB articles for plan generation | [KB Article Best Practices for Plan Generation](docId:7Zdgwrtvm6yI0lUnJL4JP) | ## Common Daily Tasks These are the most frequent tasks you will perform when working with signals in AI SOC. ### Claim a Signal **When to use:** When you are starting to investigate a signal and want to assign it to yourself. **Steps:** 1. Open the record in **Case Management** 2. In the **Controls** panel, click **Claim** 3. Verify **Current Owner** updates to your user **Why it matters:** Claiming signals prevents duplicate work and ensures clear ownership. Other analysts can see you are working on it. ### Change the Manual Verdict **When to use:** After completing your investigation, set the verdict to reflect your findings. **Steps:** 1. Open the signal record 2. In the **Triage** panel, open **Manual Verdict** 3. Select the appropriate verdict: - **Malicious:** Confirmed threat requiring response - **Suspicious:** Needs further investigation - **Benign:** False positive, no threat - **Unknown:** Insufficient data to determine 4. Save the record **Why it matters:** Manual verdicts improve AI learning and provide historical context for similar signals. ### Run Investigation Plan Steps **When to use:** Execute investigation steps from an AI-generated plan, or review results after on-record **Re-investigate** or a Trigger Analysis Agent routing run (on the record or from a routing rule). **Manual plan execution:** 1. Ensure a plan has been generated (click **Generate Plan** if needed) 2. Navigate to the appropriate phase (Preparation, Analysis, or Determination) 3. For a single step: Click **Run** on the specific step 4. For all steps in a phase: Click **Run All Steps** 5. Review results in the step timeline 6. Add notes if you modify or skip steps **Agentic investigation on the record:** 1. Set **Analysis Mode** to **Autonomous** on **Case Analysis** (case metadata column) or **Support** 2. In **AI Alert Analysis**, click **Re-investigate** to start agentic investigation (which invokes **AI SOC - Trigger Analysis Agent**) 3. Follow the **Agent Investigation** panel—the agent summarizes the case, uses TI observables, searches and runs tenant components, and reports step completion until the status badge shows **Complete** 4. Review component inputs, outputs, session summary, and verdict in **Signal Summary** 5. To run again after material changes, click **Re-investigate**, update linked **Knowledge Base Articles** first if needed, and confirm the dialog (re-investigating removes current agent progress and resets the verdict; changes cannot be reverted) **Agentic investigation via routing rules:** When a **Signal Routing Rule** runs **AI SOC - Trigger Analysis Agent via Routing Rule**, the packaged playbook invokes the **Analysis agent** on the matched record. Investigation may complete before an analyst opens the record. Review the **Rules** area on the signal to see which rule ran, then review plan and verdict fields as you would after **AI assisted investigation**. See [Building Routing Rule Playbooks](docId\:vEiFYG4oYWkQ3DcMMwjXi). **Available actions (manual plans):** - **Run:** Execute a single step - **Run All Steps:** Execute all steps in the selected phase sequentially - **Review:** Inspect what a step will do before running it - **Mark as Done:** Mark a step as completed (if done manually outside the system) - **Mark as Open:** Reopen a completed step to run it again - **Delete Step:** Remove a step from the plan - **Add Additional Step:** Insert a custom step into the plan - **Regenerate Investigation Plan:** Refresh the plan when evidence or KBAs change — see [Investigation Plan Workflow](docId\:BdE8P71Mmp2LByMuZuOOI) **Tips:** - Steps showing **Install** need integrations to be installed first - Review steps before running, especially those that modify systems - Document any deviations from the AI plan - Only components marked **Visible to Hero AI** are available to the **AI SOC - Trigger Analysis Agent** ### Escalated Status and Sustained Investigation AI SOC centers on **Case Management** records (prefix **CASE-**). When AI verdict and confidence meet thresholds your administrator configured, **pending CASE resolution** (and related playbooks) may set **Status** to **Escalated** and drive prioritization and metrics. Analysts continue investigation on the **same** record unless your organization uses a separate linked record pattern. **Sustained investigation:** Use **Claim**, **In Progress**, investigation comments, evidence, and routing rules as needed. To change when records become **Escalated** or **Closed**, administrators edit the pending CASE resolution flow in **Orchestration** → **Playbooks**. ### Add a Knowledge Base Article **When to use:** Document organization context, vendor platforms, detection rules, single-alert runbooks, or false positive patterns. **Steps:** Follow [Knowledge Base Articles (KB)](docId\:NTgNxpVESzjGY_LlqoJmF) in [Knowledge Base Articles (KB)](docId\:NTgNxpVESzjGY_LlqoJmF). Summary: 1. **Application Records** → **Knowledge Base Articles** → **Add**. 2. Set **Record Type** to **Case Management**, **Category** (for example **Best Practices**), and **Scope** (**Global**, **Signal Source**, **Signal Rule**, or **Signal Name**). 3. Set **Matching Value** to the exact source, rule, or signal name—or leave empty for **Global**. 4. Complete **Context Summary** and **Guidance**; turn **Enabled** on; **Save**. **Best practices:** - Match **Scope** to the narrowest fit (see scope table in the KB guide). - Name installed connectors and playbooks in **Guidance** so **Generate Plan** and agentic investigation suggest tenant-ready steps. - See [KB Article Best Practices for Plan Generation](docId:7Zdgwrtvm6yI0lUnJL4JP). ### Reanalyze a Signal **When to use:** After major evidence changes (new observables, completed enrichment, investigation findings). **Steps:** 1. Open the signal record 2. In the **AI Alert Analysis** panel, click **Reanalyze** 3. Hero AI re-runs the verdict analysis with updated context 4. Review the updated verdict, confidence, and analysis **Why it matters:** Reanalysis ensures verdicts stay current as new evidence is discovered. ### Review Correlation Results **When to use:** Before starting a new investigation to avoid duplicate work. **Steps:** 1. Open the signal record 2. Check the **Correlation** panel 3. Review similar signals and related cases 4. If similar signals exist: - Check how they were resolved - Review investigation notes - Determine if this is a duplicate or related incident **Why it matters:** Correlation helps identify related activity and prevents duplicate investigations. ### Automated Signal Resolution After a signal leaves **Processing**, a flow (pending signal resolution) automatically sets the signal's status based on the AI verdict and confidence: - **Escalated:** If AI verdict confidence meets the configured threshold (for example, ≥ 8) and the verdict is **Malicious** or **Suspicious**, the pending resolution flow may set the record to **Escalated** (wording and thresholds depend on your installed playbooks). - **Auto-close:** If confidence meets the threshold and the verdict is **Benign**, the signal is closed. - **New:** Otherwise (for example, verdict not yet defined), the signal is set to **New** for analyst review. **Classification** (True Positive, False Positive, Unknown) is also set in this flow. To change escalation or auto-close thresholds (for example, confidence level), administrators edit the pending signal resolution flow in **Orchestration** → **Playbooks**; this logic is not configured via assets. See Installation and Configuration for where configuration lives.