---
title: KB Article Best Practices for Plan Generation
slug: solutions/p7qk-kb-article-best-practices-for-plan-generation
docTags: 
createdAt: 2026-04-10T12:00:00.000Z
---

Hero AI reads **Guidance** and **Context Summary** from linked **KB Article** records when it builds investigation plans on **Case Management** cases. How you set **Scope**, **Matching Value**, and **Guidance** determines plan quality.

For how to create records, scope types, and UI steps, see [Knowledge Base Articles (KB)](docId\:NTgNxpVESzjGY_LlqoJmF) (**How to Create KB Articles** at the top of that page).

## Pick Scope Before You Write Guidance

| **Your content is about…**                                            | **Set Scope to**  | **Set Matching Value to**                            |
| --------------------------------------------------------------------- | ----------------- | ---------------------------------------------------- |
| Whole tenant: tools, Swimlane usage, whitelists, classification rules | **Global**        | (empty)                                              |
| One vendor or platform (for example all CrowdStrike alerts)           | **Signal Source** | Exact source on the case (for example `CrowdStrike`) |
| One detection rule covering several alert names                       | **Signal Rule**   | Exact rule identifier on the case                    |
| One alert title only                                                  | **Signal Name**   | Exact signal or alert name                           |

Use **Category** to classify the article (**Industry Frameworks**, **Best Practices**, **Memos**). Endpoint or vendor runbooks commonly use **Best Practices**.

## Use a Phase-Based Template in Guidance

Align **Guidance** with investigation plan phases. Under each phase heading, put **one discrete step per line**. Use explicit product names and actions. You can enter this in the **Guidance** rich text editor on the KB **Article** tab.

```text
Preparation:
 1. Enrich public IP observables with AbuseIPDB and Recorded Future.
 2. Enrich file hashes with VirusTotal.

Analysis:
---
 1. Query CrowdStrike for related detections for the host name from the alert.
 2. Search the Elastic SIEM for events involving the same user in the last 24 hours.

Containment:
---
 1. Isolate the host using the CrowdStrike containment action.

Eradication:
---
Recovery:
---
```

:::hint{type="info"}
**One step per line:** Split multiple vendors or tools into separate numbered lines so Hero AI can map each line to a Turbine component when one exists.
:::

## What to Document in Guidance (Beyond Steps)

Include content plan generation can use to choose connectors and playbooks:

- **Platform role:** For **Signal Source** articles, state what the source is (for example endpoint security with CrowdStrike).
- **Swimlane integrations:** Name connectors and components installed in your tenant for that scope.
- **Playbooks:** Note standard playbooks analysts or automation should use.
- **Key data points:** Which alert or case fields to read for lookups.
- **Whitelists / blocklists:** Approved assets, domains, or scanners; platform-level exceptions.
- **Classification principles:** When to escalate or close without over-relying on a single enrichment source.

## Example Guidance by Scope

### Global

```text
Environment:
 - Identity: JumpCloud. Endpoint: CrowdStrike. SIEM: Elastic. Ticketing: Jira.
 - Use CrowdStrike components for host enrichment; JumpCloud components for user identity.

Investigation practices:
 - Review user and host activity for the last 24 hours; extend to seven days when findings are suspicious.

Classification principles:
 - Do not classify as Malicious from VirusTotal alone without corroborating case evidence.
```

**Scope:** Global. **Matching Value:** empty.

### Signal Source (CrowdStrike)

```text
Preparation:
 1. Enrich host observables with the CrowdStrike Threat Graph component.

Analysis:
---
 1. Pull process chain and detection context from CrowdStrike using the alert detection ID.
```

**Scope:** Signal Source. **Matching Value:** `CrowdStrike` (must match case **Signal Source**).

### Signal Name (Login Failure)

```text
Analysis:
---
 1. Compare current login IP to the user’s usual ISP and working hours.

Determination:
---
 1. If four or more consecutive failures or region differs from usual, favor Malicious.
```

**Scope:** Signal Name. **Matching Value:** exact alert title on the case.

## Write Concrete, Tool-Specific Lines

- Name products and actions instead of vague instructions.
- State observable types (public IP, hash, domain) where enrichment steps depend on them.
- Use the same phase headings across articles so merged context stays consistent.

## Components Must Exist in Your Tenant

Plan generation maps **Guidance** lines to components in your tenant or **Marketplace**. Install and publish connectors before you reference them in KB articles.

## When Plans Still Differ From the KB

1. Confirm **Scope** and **Matching Value** match the case (and that **Enabled** is on).
2. Confirm articles exist at the right scope (global plus source or name as needed).
3. Confirm **Guidance** uses phases and one step per line with installed tools named.
4. Re-run **Generate Plan** after KB or evidence updates.

## See Also

- [Knowledge Base Articles (KB)](docId\:NTgNxpVESzjGY_LlqoJmF) — Create workflow, fields, scope table
- [Investigation Plan Workflow](docId\:BdE8P71Mmp2LByMuZuOOI)
- [Operations and Guidance](docId\:DsdGtAQeg95DSeAF2Iat-)