KB Article Best Practices for Plan Generation

Hero AI reads Guidance and Context Summary from linked KB Article records when it builds investigation plans on Case Management cases. How you set Scope, Matching Value, and Guidance determines plan quality.

For how to create records, scope types, and UI steps, see Knowledge Base Articles (KB)Knowledge Base Articles (KB) (How to Create KB Articles at the top of that page).

Pick Scope Before You Write Guidance

Your content is about…	Set Scope to	Set Matching Value to
Whole tenant: tools, Swimlane usage, whitelists, classification rules	Global	(empty)
One vendor or platform (for example all CrowdStrike alerts)	Signal Source	Exact source on the case (for example CrowdStrike)
One detection rule covering several alert names	Signal Rule	Exact rule identifier on the case
One alert title only	Signal Name	Exact signal or alert name

Use Category to classify the article (Industry Frameworks, Best Practices, Memos). Endpoint or vendor runbooks commonly use Best Practices.

Use a Phase-Based Template in Guidance

Align Guidance with investigation plan phases. Under each phase heading, put one discrete step per line. Use explicit product names and actions. You can enter this in the Guidance rich text editor on the KB Article tab.

Preparation:
 1. Enrich public IP observables with AbuseIPDB and Recorded Future.
 2. Enrich file hashes with VirusTotal.

Analysis:
---
 1. Query CrowdStrike for related detections for the host name from the alert.
 2. Search the Elastic SIEM for events involving the same user in the last 24 hours.

Containment:
---
 1. Isolate the host using the CrowdStrike containment action.

Eradication:
---
Recovery:
---

One step per line: Split multiple vendors or tools into separate numbered lines so Hero AI can map each line to a Turbine component when one exists.

What to Document in Guidance (Beyond Steps)

Include content plan generation can use to choose connectors and playbooks:

Platform role: For Signal Source articles, state what the source is (for example endpoint security with CrowdStrike).

Swimlane integrations: Name connectors and components installed in your tenant for that scope.

Playbooks: Note standard playbooks analysts or automation should use.

Key data points: Which alert or case fields to read for lookups.

Whitelists / blocklists: Approved assets, domains, or scanners; platform-level exceptions.

Classification principles: When to escalate or close without over-relying on a single enrichment source.

Example Guidance by Scope

Global

Environment:
 - Identity: JumpCloud. Endpoint: CrowdStrike. SIEM: Elastic. Ticketing: Jira.
 - Use CrowdStrike components for host enrichment; JumpCloud components for user identity.

Investigation practices:
 - Review user and host activity for the last 24 hours; extend to seven days when findings are suspicious.

Classification principles:
 - Do not classify as Malicious from VirusTotal alone without corroborating case evidence.

Scope: Global. Matching Value: empty.

Signal Source (CrowdStrike)

Preparation:
 1. Enrich host observables with the CrowdStrike Threat Graph component.

Analysis:
---
 1. Pull process chain and detection context from CrowdStrike using the alert detection ID.

Scope: Signal Source. Matching Value: CrowdStrike (must match case Signal Source).

Analysis:
---
 1. Compare current login IP to the user’s usual ISP and working hours.

Determination:
---
 1. If four or more consecutive failures or region differs from usual, favor Malicious.

Scope: Signal Name. Matching Value: exact alert title on the case.

Write Concrete, Tool-Specific Lines

Name products and actions instead of vague instructions.

State observable types (public IP, hash, domain) where enrichment steps depend on them.

Use the same phase headings across articles so merged context stays consistent.

Components Must Exist in Your Tenant

Plan generation maps Guidance lines to components in your tenant or Marketplace. Install and publish connectors before you reference them in KB articles.

When Plans Still Differ From the KB

Confirm Scope and Matching Value match the case (and that Enabled is on).

Confirm articles exist at the right scope (global plus source or name as needed).

Confirm Guidance uses phases and one step per line with installed tools named.

Re-run Generate Plan after KB or evidence updates.