--- title: Playbook Flow Reference slug: solutions/playbook-flow-reference docTags: createdAt: 2026-06-01T13:54:15.989Z --- This reference maps AI SOC playbooks and flows to triggers, inputs, outputs, and handoffs. Use it with [Playbook Types and Usage](docId\:Np4vvQLU6pnRWzSbEL_EO) (when to use each playbook) and [Architecture and Data Flow](docId\:kWCIabPwqOzQcjd2eZtic) (conceptual pipeline diagrams). :::hint{type="info"} **This is a reference page, not a starting point.** Read [Architecture and Data Flow](docId\:kWCIabPwqOzQcjd2eZtic) first for diagrams and the end-to-end story. Use this page when you need flow titles, triggers, handoffs, or playbook troubleshooting. For analyst procedures, see [Getting Started](docId\:p7QJQUayeKczHPxEpPWcp) and [Operations and Guidance](docId\:DsdGtAQeg95DSeAF2Iat-). ::: :::hint{type="info"} Playbook bundle names, flow titles, and component counts can differ by installed package version. Treat flow tables marked **Verify in tenant** as outlines—confirm exact flow names and step order in **Orchestration** → **Playbooks** after import. ::: ## Choose Your Path | **If You Need To...** | **Start Here** | | ---------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Understand what each playbook category does | [Playbook Types and Usage](docId\:Np4vvQLU6pnRWzSbEL_EO) | | See how alert and email traffic converges on **Case Management** | [Playbook Handoffs at a Glance](https://docs.swimlane.com/solutions/playbook-flow-reference#playbook-handoffs-at-a-glance) → [Event Channels](https://docs.swimlane.com/solutions/playbook-flow-reference#event-channels-inter-playbook-handoffs) | | Configure a new SIEM or email source | [Ingestion Template Playbooks](https://docs.swimlane.com/solutions/playbook-flow-reference#ingestion-template-playbooks) → [Configure Ingestion Playbooks](docId\:B1-f6uEPZ95dFN5nNl0lA) | | Trace what happens after a **CASE-** record is created | [CASE Lifecycle Flows](https://docs.swimlane.com/solutions/playbook-flow-reference#case-lifecycle-flows) | | Build or debug a routing rule playbook | [Routing Rule Playbooks](https://docs.swimlane.com/solutions/playbook-flow-reference#routing-rule-playbooks) → [Building Routing Rule Playbooks](docId\:vEiFYG4oYWkQ3DcMMwjXi) | ## How to Read This Reference Each playbook section includes: | **Column** | **Meaning** | | ------------------- | --------------------------------------------------------------------- | | **Flow** | Flow title inside the playbook bundle (as shown in **Orchestration**) | | **Trigger** | Sensor, schedule, flow event, or record event that starts the flow | | **Primary Inputs** | Payload, record fields, or event data the flow consumes | | **Primary Outputs** | Records, flow events, or fields the flow produces | | **Hands Off To** | Next flow, event channel, application, or background process | **Logical stage** rows (for example, Deduplicate, Enrich observables) describe the ingestion pipeline documented in configuration guides when individual flow titles are not named in customer docs. ## Playbook Index | **Playbook Bundle** | **Category** | **Analyst Action** | **Detailed Section** | | --------------------------------------------- | -------------------------- | ----------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------- | | AI SOC – Alert Ingestion (Webhook) – Template | Ingestion template | None (configure, then enable) | [Ingestion Template Playbooks](https://docs.swimlane.com/solutions/playbook-flow-reference#ingestion-template-playbooks) | | AI SOC – Alert Ingestion (Cron) – Template | Ingestion template | None | [Ingestion Template Playbooks](https://docs.swimlane.com/solutions/playbook-flow-reference#ingestion-template-playbooks) | | AI SOC – Phishing Ingestion (Cron) – Template | Ingestion template | None | [Ingestion Template Playbooks](https://docs.swimlane.com/solutions/playbook-flow-reference#ingestion-template-playbooks) | | AI SOC – Test Email Ingestion (Webhook) | Test / lab | None | [Ingestion Template Playbooks](https://docs.swimlane.com/solutions/playbook-flow-reference#ingestion-template-playbooks) | | AI SOC – Test CASE Generator | Test / lab | None | [Ingestion Template Playbooks](https://docs.swimlane.com/solutions/playbook-flow-reference#ingestion-template-playbooks) | | Ingest Webhook Alert | Production alert ingestion | None | [Production Ingestion Playbooks](https://docs.swimlane.com/solutions/playbook-flow-reference#production-ingestion-playbooks) | | Ingest Bulk Alerts | Production alert ingestion | None | [Production Ingestion Playbooks](https://docs.swimlane.com/solutions/playbook-flow-reference#production-ingestion-playbooks) | | Ingest Email to SIG Record | Production email ingestion | None | [Production Ingestion Playbooks](https://docs.swimlane.com/solutions/playbook-flow-reference#production-ingestion-playbooks) | | Ingest Alert to CASE Record (Event) | Entry / normalization | None | [Entry Flows](https://docs.swimlane.com/solutions/playbook-flow-reference#entry-flows-case-record-creation) | | Ingest Email to CASE Record (Event) | Entry / normalization | None | [Entry Flows](https://docs.swimlane.com/solutions/playbook-flow-reference#entry-flows-case-record-creation) | | SOC – Enrich Observables | Enrichment | None | [Enrichment and Knowledge](https://docs.swimlane.com/solutions/playbook-flow-reference#enrichment-and-knowledge-playbooks) | | Link Knowledge Base Articles | Enrichment | None | [Enrichment and Knowledge](https://docs.swimlane.com/solutions/playbook-flow-reference#enrichment-and-knowledge-playbooks) | | Alert Triage Playbook Template | Triage / verdict | Manual or rule-driven | [Triage and Verdict Playbooks](https://docs.swimlane.com/solutions/playbook-flow-reference#triage-and-verdict-playbooks) | | Case correlation (AI SOC - Main) | Correlation | Scheduled (AI SOC - Main) | [Triage and Verdict Playbooks](https://docs.swimlane.com/solutions/playbook-flow-reference#triage-and-verdict-playbooks) | | Run Rule Against Pending Signals | Routing | Manual (**Routing Rule** **Support** tab) | [Triage and Verdict Playbooks](https://docs.swimlane.com/solutions/playbook-flow-reference#triage-and-verdict-playbooks) | | Custom routing rule playbooks | Routing | None (rule-driven) | [Routing Rule Playbooks](https://docs.swimlane.com/solutions/playbook-flow-reference#routing-rule-playbooks) | | Pending CASE resolution (and related) | Lifecycle | None | [CASE Lifecycle Flows](https://docs.swimlane.com/solutions/playbook-flow-reference#case-lifecycle-flows) | *** ## Event Channels (Inter-Playbook Handoffs) AI SOC separates alert-shaped and email-shaped traffic on internal flow event channels before both paths create **Case Management** records. | **Channel** | **Payload Shape** | **Producers (Examples)** | **Consumer** | | ----------------- | ------------------------------------------- | ---------------------------------------------------------------------------------------------- | --------------------------------------- | | **Ingest\_Alert** | Turbine Schema alert object | **Ingest Webhook Alert**, **Ingest Bulk Alerts**, configured cron/webhook templates | **Ingest Alert to CASE Record (Event)** | | **Ingest\_Email** | Turbine Schema email object | **AI SOC – Phishing Ingestion (Cron) – Template**, **AI SOC – Test Email Ingestion (Webhook)** | **Ingest Email to CASE Record (Event)** | | **Rule-Execute** | Rule UUID + **Case Management** tracking ID | Signal routing rules engine | Compatible routing rule playbooks | See [Architecture and Data Flow](docId\:kWCIabPwqOzQcjd2eZtic) for additional conceptual pipeline diagrams. *** ## Playbook Handoffs at a Glance The diagram below shows how alert and email traffic converges on **Case Management**, passes evaluation gates, and branches into resolution and routing. Thresholds and automatic outcomes are **tenant-configured**. ![Playbook handoffs at a glance — sources, event channels, CASE record creation, evaluation gates, resolution, and Rule-Execute routing](../images/playbook-handoffs-at-a-glance.svg) | **Diagram region** | **What to look up in this reference** | | ------------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | | Sources → event channels | [Ingestion Template Playbooks](https://docs.swimlane.com/solutions/playbook-flow-reference#ingestion-template-playbooks), [Production Ingestion Playbooks](https://docs.swimlane.com/solutions/playbook-flow-reference#production-ingestion-playbooks) | | Entry flows → **CASE-** record | [Entry Flows (CASE Record Creation)](https://docs.swimlane.com/solutions/playbook-flow-reference#entry-flows-case-record-creation) | | Evaluation gates | [Evaluation Gates](https://docs.swimlane.com/solutions/playbook-flow-reference#evaluation-gates), [CASE Lifecycle Flows](https://docs.swimlane.com/solutions/playbook-flow-reference#case-lifecycle-flows) | | Pending resolution branches | [CASE Lifecycle Flows](https://docs.swimlane.com/solutions/playbook-flow-reference#case-lifecycle-flows) → **Pending CASE Resolution outcomes** | | **Rule-Execute** routing | [Routing Rule Playbooks](https://docs.swimlane.com/solutions/playbook-flow-reference#routing-rule-playbooks) | *** ## Ingestion Template Playbooks Duplicate templates before configuration. Do not edit originals. See [Configure Ingestion Playbooks](docId\:B1-f6uEPZ95dFN5nNl0lA). ### AI SOC – Alert Ingestion (Webhook) – Template | **Flow** | **Trigger** | **Primary Inputs** | **Primary Outputs** | **Hands Off To** | | -------------------------- | ------------------- | ------------------------ | ----------------------------------------------- | --------------------------------------- | | **Ingest Webhook Alert** | HTTP webhook sensor | Raw vendor alert payload | Turbine Schema alert on **Ingest\_Alert** | **Ingest Alert to CASE Record (Event)** | | \*Logical stages in flow\* | — | Webhook payload | Extended alert fields, deduplicated observables | See pipeline table below | **Documented pipeline (logical order):** Receive webhook → Convert to Turbine Schema → Extend with custom fields → Deduplicate → Enrich observables → Create or update **Case Management** records. Correlation runs separately on a schedule through **AI SOC - Main**. | **Logical Stage** | **Key Component (Configure on Duplicate)** | **Input** | **Output** | | ------------------------- | ------------------------------------------ | -------------------- | ------------------------------------------------------ | | Convert to Turbine Schema | **Placeholder - Get TEDS Alerts** | Webhook payload | Turbine Schema alert | | Extend fields | **AI SOC - Extend TEDS Alert** | Turbine Schema alert | **Case Management** field mappings, raw JSON preserved | | Emit | \*Verify in tenant duplicate\* | Normalized alert | **Ingest\_Alert** channel event | ### AI SOC – Alert Ingestion (Cron) – Template | **Flow** | **Trigger** | **Primary Inputs** | **Primary Outputs** | **Hands Off To** | | ---------------------- | --------------------------------------- | --------------------------- | ------------------------------------------ | --------------------------------------- | | **Ingest Bulk Alerts** | CRON schedule; **Ingest\_Alert** sensor | Bulk alerts from source API | Turbine Schema alerts on **Ingest\_Alert** | **Ingest Alert to CASE Record (Event)** | **Documented pipeline:** Fetch alerts → Convert to Turbine Schema → Extend with custom fields → Deduplicate → Enrich observables → Create or update **Case Management** records. Correlation runs separately on a schedule through **AI SOC - Main**. | **Logical Stage** | **Key Component (Configure on Duplicate)** | **Input** | **Output** | | ----------------- | ------------------------------------------------- | --------------------- | ------------------------------- | | Fetch and convert | **Placeholder - Get TEDS Alerts** | Source API response | Turbine Schema alert list | | Extend fields | **AI SOC - Extend TEDS Alerts (Bulk) - Template** | Turbine Schema alerts | **Case Management** mappings | | Emit | \*Verify in tenant duplicate\* | Each alert | **Ingest\_Alert** channel event | ### AI SOC – Phishing Ingestion (Cron) – Template | **Flow** | **Trigger** | **Primary Inputs** | **Primary Outputs** | **Hands Off To** | | ---------------------------------------- | ------------- | --------------------------------------------- | ------------------------------------------------- | --------------------------------------- | | Scheduled TEDS email fetch and emit loop | CRON schedule | Unread mailbox items (Graph, IMAP, and so on) | Email Turbine Schema objects on **Ingest\_Email** | **Ingest Email to CASE Record (Event)** | **Documented pipeline:** Retrieve emails → Convert to Email Turbine Schema → Extend with custom fields → Deduplicate → Enrich observables → Create or update **Case Management** records. Correlation runs separately on a schedule through **AI SOC - Main**. | **Logical Stage** | **Key Component (Configure on Duplicate)** | **Input** | **Output** | | -------------------- | ------------------------------------------------------------------------------------ | ---------------------- | ---------------------------------------------------------------- | | Retrieve and convert | **Placeholder - Get TEDS Emails** | Mailbox search results | Email Turbine Schema | | Extend fields | **AI SOC - Extend TEDS Alerts (Bulk) - Template** | Email object | Observables (URLs, sender, hashes), **Case Management** mappings | | Emit | **Emit TEDS Email** (per [Architecture and Data Flow](docId\:kWCIabPwqOzQcjd2eZtic)) | Email object | **Ingest\_Email** channel event | ### AI SOC – Test Email Ingestion (Webhook) | **Flow** | **Trigger** | **Primary Inputs** | **Primary Outputs** | **Hands Off To** | | ------------------------------------------- | ------------ | ------------------------- | --------------------------------- | --------------------------------------- | | **Emit Test Email to Email Ingestion Flow** | HTTP webhook | Lab or test email payload | Email object on **Ingest\_Email** | **Ingest Email to CASE Record (Event)** | ### AI SOC – Test CASE Generator | **Flow** | **Trigger** | **Primary Inputs** | **Primary Outputs** | **Hands Off To** | | ------------------------------- | -------------------- | -------------------- | ------------------------------- | -------------------- | | **AI SOC Alert Case Generator** | \*Verify in tenant\* | Synthetic alert data | **Case Management** test record | CASE lifecycle flows | | **Phishing Case Generator** | \*Verify in tenant\* | Synthetic email data | **Case Management** test record | CASE lifecycle flows | *** ## Production Ingestion Playbooks Configured copies of templates (or package defaults). Names may omit "Template" or use **SOC -** prefix in older bundles. | **Playbook** | **Trigger** | **Primary Inputs** | **Primary Outputs** | **Hands Off To** | | ------------------------------ | -------------- | ----------------------- | --------------------------------------------------- | --------------------------------------- | | **Ingest Webhook Alert** | Webhook sensor | Real-time alert payload | **Ingest\_Alert** events | **Ingest Alert to CASE Record (Event)** | | **Ingest Bulk Alerts** | CRON schedule | Scheduled bulk fetch | **Ingest\_Alert** events | **Ingest Alert to CASE Record (Event)** | | **Ingest Email to SIG Record** | Email sensor | Phishing report email | **Ingest\_Email** events (name may include **SIG**) | **Ingest Email to CASE Record (Event)** | :::hint{type="info"} **Alert Schema Store (AWSS)** caches example payloads and Turbine Schema field mappings so repeat vendor formats map consistently on the alert path. See [Architecture and Data Flow](docId\:kWCIabPwqOzQcjd2eZtic). ::: *** ## Entry Flows (CASE Record Creation) Shared downstream playbooks that materialize **Case Management** records (prefix **CASE-**). ### Ingest Alert to CASE Record (Event) | **Flow** | **Trigger** | **Primary Inputs** | **Primary Outputs** | **Hands Off To** | | --------------------------------------- | ---------------------------- | --------------------------- | ------------------------------------------------------ | ------------------------------------------------------------------ | | **Ingest Alert to CASE Record (Event)** | **Ingest\_Alert** flow event | Turbine Schema alert object | New or updated **CASE-** record, extracted observables | Enrichment, KB linking, correlation, **CASE Evaluation Automated** | **Logical steps inside the flow** (confirm sub-playbook names in **Orchestration**): | **Step** | **Purpose** | **Primary Inputs** | **Primary Outputs** | | ------------------------- | ------------------------------------------------- | ----------------------------------------------- | ---------------------------------------------- | | Deduplicate | Skip or update when alert identity already exists | Alert unique identifier (for example alert UID) | Stop, or continue for new alert | | Normalize observables | Map vendor fields to Turbine Schema | Raw alert payload | Turbine Schema alert object | | Enrich observables | TI lookup on extracted observables | Observables | **Threat Intelligence Reference**, risk scores | | Find matching KB articles | Link guidance for plan generation | **Matching Value**, observables | **KB Article** references on record | | Create or update record | Materialize work in **Case Management** | Normalized alert + enrichment results | **CASE-** record (**Processing**) | ### Ingest Email to CASE Record (Event) | **Flow** | **Trigger** | **Primary Inputs** | **Primary Outputs** | **Hands Off To** | | --------------------------------------- | ---------------------------- | --------------------------- | ---------------------------------------- | -------------------------------- | | **Ingest Email to CASE Record (Event)** | **Ingest\_Email** flow event | Turbine Schema email object | New or updated phishing **CASE-** record | Same logical steps as alert path | Email payloads preserve email-specific fields (for example subject, sender, recipient) on the **Case Management** record alongside standard observables. *** ## Evaluation Gates Automated evaluation on a **CASE-** record typically waits until enrichment and correlation complete. Confirm field names on your **Case Management** application layout. | **Gate** | **Field (typical)** | **Set By** | **Required Before** | | ---------------------------- | ------------------------------ | --------------------------------------------------------------------------------------- | ----------------------------- | | Threat intelligence complete | **Threat Intelligence Status** | **AI SOC - Enrich Observables** or **Check Threat Intelligence Results** on **Support** | **CASE Evaluation Automated** | | Correlation complete | **Correlation Status** | **AI SOC - Correlate Current Case Record** (scheduled in **AI SOC - Main**) | **CASE Evaluation Automated** | When both gates are **Complete**, **CASE Evaluation Automated** can run the rules engine and, if no rule matches, invoke Hero AI for an initial AI verdict and confidence score. :::hint{type="info"} While **Status** is **Processing**, enrichment, correlation, KB linking, and automated evaluation may still be running. Wait until the record leaves **Processing** before **Generate Plan** or expecting a stable AI verdict. See [Case Management (CASE)](docId\:sDpESfT6Lsyz0zfrn_hok). ::: *** ## Enrichment and Knowledge Playbooks | **Playbook / Component** | **Trigger** | **Primary Inputs** | **Primary Outputs** | **Hands Off To** | | -------------------------------------------------------------- | ------------------------------------------------ | ------------------------------------------------ | -------------------------------------------------------------------------- | ------------------------------------------------------------------ | | **SOC – Enrich Observables** / **AI SOC - Enrich Observables** | Signal or record creation; observable extraction | Observables (IP, domain, URL, hash) | TI provider results, aggregated verdict, **Threat Intelligence Reference** | **Case Management** evidence panels; **CASE Evaluation Automated** | | **Link Knowledge Base Articles** | Signal creation or correlation | **Matching Value**, observables, signal metadata | Linked **KB Article** records on case | Hero AI **Generate Plan** context | ### TI Provider Components (Inside Enrichment) | **Component** | **Input** | **Output** | | ---------------------------------------------------- | ---------- | ---------------------------- | | **Enrich - VirusTotal Enrich Observable (VIC)** | Observable | Provider-specific enrichment | | **Enrich - Recorded Future Enrich Observable (VIC)** | Observable | Provider-specific enrichment | | **Enrich - AbuseIPDB Enrich Observable (VIC)** | Observable | Provider-specific enrichment | | **Enrich - URLHaus Enrich Observables (VIC)** | Observable | Provider-specific enrichment | | **Enrich - IPQualityScore Enrich Observable (VIC)** | Observable | Provider-specific enrichment | Configuration: [Configure Threat Intelligence Enrichment](docId:_wafAIm1sG-7z1UZmvr-P). *** ## Triage and Verdict Playbooks | **Playbook** | **Trigger** | **Primary Inputs** | **Primary Outputs** | **Hands Off To** | | ------------------------------------ | ------------------------------------------------------------------- | ----------------------------------------------- | ----------------------------------------- | ----------------------------------------------- | | **Alert Triage Playbook Template** | Manual run or **Rule-Execute** | **CASE-** record context | Refreshed Hero AI verdict and TI analysis | **Case Management** **AI Alert Analysis** panel | | **Case correlation (AI SOC - Main)** | CRON schedule in **AI SOC - Main** (default about every 10 minutes) | **CASE-** record | Correlation evidence | **Case Management** **Correlation** panel | | **Run Rule Against Pending Signals** | Manual (**Routing Rule** **Support** tab) | Pending **CASE-** records for the selected rule | Rule evaluation results | **Rule-Execute** → investigation playbooks | *** ## Routing Rule Playbooks Custom or duplicated playbooks associated on **Signal Routing Rules** records. Required pattern: | **Step Order** | **Action** | **Primary Inputs** | **Primary Outputs** | | -------------- | ------------------------------------------------------------------ | -------------------------- | ---------------------------------- | | 1 | **Flow Event** trigger (**Rule-Execute**) | Rule UUID, tracking ID | Flow context | | 2 | **Search Records** | Event tracking ID | **Case Management** record in flow | | 3 | \*Optional investigation steps\* | Record + connector actions | Step outputs in **�0�** | | 4 | Verdict component (for example **AI SOC - CASE Hero AI Analysis**) | Record + **�0�** | AI verdict, updated case fields | | **Constraint** | **Requirement** | | ---------------- | ----------------------------------------------------------------- | | Flow count | **Single flow** per investigation playbook | | Verdict evidence | Expression **�0�** | | Rule binding | **Rule UUID** condition added when you **Apply rule to playbook** | See [Building Routing Rule Playbooks](docId\:vEiFYG4oYWkQ3DcMMwjXi) and [Signal Routing Rules (RULE)](docId\:biJF7m9ETYmpud9-AOzbL). *** ## CASE Lifecycle Flows Background automation after **CASE-** records are created. Flow titles vary by package; confirm in **Orchestration** → **Playbooks**. ### Enrichment and Correlation | **Flow / Component** | **Trigger** | **Primary Inputs** | **Primary Outputs** | **Hands Off To** | | ------------------------------------------ | -------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------ | ------------------------------------ | | **AI SOC - Enrich Observables** | Record create or **Check Threat Intelligence Results** on **Support** | Observables on **CASE-** record | **Threat Intelligence Reference**, **Intelligence Verdict**, **Threat Intelligence Status** = Complete | **CASE Evaluation Automated** (gate) | | **AI SOC - Correlate Current Case Record** | CRON schedule in **AI SOC - Main** (tenant-configured; default about every 10 minutes) | **CASE-** record + pool from **AI SOC - Get CASE Records to Correlate Against** | **Correlation Status** = Complete, **Correlation** evidence | **CASE Evaluation Automated** (gate) | Correlation uses the **AI SOC Correlation Configuration** asset for delay windows and match thresholds. Records are typically eligible after a short delay so ingestion and enrichment can finish first. ### Evaluation and Resolution | **Flow / Component** | **Trigger** | **Primary Inputs** | **Primary Outputs** | **Hands Off To** | | ----------------------------- | ----------------------------------------------------------------- | ------------------------------------------------------- | ----------------------------------------------------------------- | --------------------------- | | **CASE Evaluation Automated** | Record update when both TI and correlation gates are **Complete** | **CASE-** fields, TI results, correlation | Rule match results; or AI verdict + confidence if no rule matches | **Pending CASE Resolution** | | **Pending CASE Resolution** | AI verdict or confidence change (conditions vary by package) | **AI Verdict**, **Confidence Score**, tenant thresholds | **Status**, **Classification**, **Escalated** (when configured) | Analyst queue or closure | **Pending CASE Resolution outcomes** (thresholds are **tenant-configured** in the pending CASE resolution flow — not fixed defaults): | **Condition (typical)** | **Outcome on Case Management record** | | ----------------------------------------------------- | ------------------------------------------------------------------- | | High confidence + **Malicious** or **Suspicious** | **Escalated** or sustained investigation path per your tenant rules | | High confidence + **Benign** | **Closed** with false-positive classification where configured | | Verdict present but confidence below tenant threshold | **New** — analyst review required | | Analyst override | Manual **Manual Verdict**, **Status**, or **Claim** | :::hint{type="info"} Some packages link a separate investigative record through a case-tracking reference field. Current AI SOC guidance centers triage and investigation on the same **Case Management** (**CASE-**) record unless your organization configured a linked-record pattern. See [Case Management (CASE)](docId\:sDpESfT6Lsyz0zfrn_hok). ::: ### Metrics and Sync | **Flow / Component** | **Trigger** | **Primary Inputs** | **Primary Outputs** | | ------------------------------- | ---------------------------------------------- | -------------------------- | ------------------------------------------------------------------------- | | **Update CASE Metrics** | **Status**, owner, or mitigation field changes | **CASE-** lifecycle fields | SLA timestamps (for example time assigned, time closed) | | **Sync case to linked records** | Record field change or manual button | **CASE-** record | Patched linked records and timeline entries (when linked pattern is used) | ### Routing and Rules Engine | **Flow / Control** | **Trigger** | **Primary Inputs** | **Primary Outputs** | **Hands Off To** | | ------------------------------------------------------------- | ------------------------------------------------- | --------------------------------------------- | ----------------------- | ---------------------- | | **Signal Routing Rules** (engine) | Evaluation or schedule | **CASE-** fields vs rule conditions | **Rule-Execute** events | Routing rule playbooks | | **Run Rules Engine** (**Support** tab on **Case Management**) | Manual button | Current **CASE-** record | Rule match results | Routing rule playbooks | | **Run Rule Against Pending Signals** | Manual button on **Routing Rule** **Support** tab | Pending **CASE-** queue for the selected rule | Rule match results | Routing rule playbooks | *** ## Support Tab Button Runbooks Analyst-initiated actions on **Case Management** records. Available buttons depend on layout and RBAC. | **Button (typical label)** | **Purpose** | **When to Use** | | ------------------------------------- | ------------------------------------------------- | ------------------------------------------------------- | | **Claim Case** | Assign **Current Owner** to the logged-in analyst | Starting investigation; prevents duplicate work | | **Unclaim Case** | Clear **Current Owner** | Hand off to another analyst | | **Check Threat Intelligence Results** | Force TI enrichment on the current record | TI status stuck or observables changed | | **Run Rules Engine** | Evaluate routing rules on the current record | Test or refresh rule matches | | **AI Case Analysis** | Force Hero AI verdict and confidence | Evaluation skipped a rule match, or after new evidence | | **Generate After Actions Report** | Merge KB, TI, and connector outputs into a report | Post-incident documentation (connectors vary by tenant) | See [Case Management (CASE)](docId\:sDpESfT6Lsyz0zfrn_hok) and [Troubleshooting](docId\:cKnuXQV85k9lu0OCqV218) for button visibility and RBAC issues. *** ## Troubleshooting by Flow | **Symptom** | **Check First** | **Quick Fix** | | ---------------------------------- | ----------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------- | | No **CASE-** record after ingest | **Ingest\_Alert** / **Ingest\_Email** sensor enabled; alert UID present | Verify webhook or cron template; confirm deduplication did not stop on duplicate | | Record stuck in **Processing** | **Threat Intelligence Status** and **Correlation Status** | Run **Check Threat Intelligence Results** from **Support**; verify TI connectors; wait for scheduled correlation | | **CASE Evaluation** never runs | Both gates **Complete** on same record | Complete missing enrichment or correlation; check correlation asset and schedule | | No AI verdict | Rules engine matched (AI branch skipped) | **AI Case Analysis** from **Support**; verify Hero AI enabled | | No auto **Escalated** / **Closed** | Tenant thresholds in pending CASE resolution | Review administrator playbook config; set **Manual Verdict** if needed | | Routing rule never fires | Rule **Enabled**; playbook uses **Rule-Execute** | **Run Rules Engine**; see [Building Routing Rule Playbooks](docId\:vEiFYG4oYWkQ3DcMMwjXi) | | **Generate Plan** missing | Record still **Processing**; RBAC / widget config | Wait for gates; see [Getting Started](docId\:p7QJQUayeKczHPxEpPWcp) and [RBAC Considerations for AI SOC](docId\:Jl6Dsw0QjBkPq_iOJDgLp) | *** ## Key Shared Components Components referenced across multiple playbooks. Connector-embedded business logic actions should be documented with plain-language descriptions when added or renamed. | **Component** | **Used In** | **Purpose** | | -------------------------------------------------- | ------------------------------------------------------------------------------------------------- | -------------------------------------------------- | | **Placeholder - Get TEDS Alerts** | Alert ingestion templates | Fetch or map source alerts to Turbine Schema | | **Placeholder - Get TEDS Emails** | Phishing ingestion template | Fetch or map emails to Email Turbine Schema | | **AI SOC - Extend TEDS Alert** | Webhook alert template | Map Turbine Schema to **Case Management** (single) | | **AI SOC - Extend TEDS Alerts (Bulk) - Template** | Cron alert and phishing templates | Map Turbine Schema to **Case Management** (bulk) | | **AI SOC - Get CASE Records to Correlate Against** | **AI SOC - Main** correlation schedule | Build candidate record pool for correlation | | **AI SOC - Correlate Current Case Record** | **AI SOC - Main** correlation schedule | Match and link related **CASE-** records | | **AI SOC - Enrich Observables** | Ingestion and enrichment playbooks | Multi-provider TI enrichment | | **AI SOC - CASE Hero AI Analysis** | Triage templates, routing rules, plans | Hero AI verdict on **Case Management** records | | **AI SOC - Trigger Analysis Agent** | **AI SOC - Trigger Analysis Agent via Routing Rule**, **Re-investigate** in **AI Alert Analysis** | Agentic investigation on a **CASE-** record | | **AI SOC - Alerts to Turbine Schema** | AI Ingestion widget output | Normalize vendor alerts to Turbine Schema | | **Create TEDS Alert** | Custom ingestion / Integration Examples | Map vendor fields to Turbine Schema | *** ## End-to-End Flow Summary | **Stage** | **Representative Playbooks / Flows** | **Case Management Impact** | | ------------------ | -------------------------------------------------------- | ----------------------------------------------- | | 1. Source ingest | Ingest templates → **Ingest\_Alert** / **Ingest\_Email** | None yet | | 2. Normalize | **Ingest Alert/Email to CASE Record (Event)** | **CASE-** record created (**Processing**) | | 3. Enrich and link | **Enrich Observables**, **Link Knowledge Base Articles** | Evidence panels populated | | 4. Evaluate | **CASE Evaluation Automated**, correlation schedule | Correlation, KB, TI complete | | 5. Route | Signal routing rules → **Rule-Execute** playbooks | Automated investigation steps | | 6. Resolve | **Pending CASE Resolution**, prioritization | **Status**, **Priority**, **Escalated** | | 7. Investigate | Analyst **Generate Plan**, manual verdict | **Manual Verdict**, **Classification**, closure | *** ## Key Record Fields (Reference) Typical **Case Management** fields referenced across flows. Labels on your layout may differ slightly. | **Field area** | **Examples** | **Used By** | | ------------------ | ---------------------------------------------------------------- | --------------------------------------- | | Identity | Tracking ID, alert UID, **Signal Source**, **Signal Type** | Ingestion, deduplication, routing rules | | Observables | IPs, domains, URLs, hashes | TI enrichment, correlation, Hero AI | | Enrichment gates | **Threat Intelligence Status**, **Correlation Status** | **CASE Evaluation Automated** | | AI triage | **AI Verdict**, **Confidence Score**, **Intelligence Verdict** | **Pending CASE Resolution**, analyst UI | | Workflow | **Status**, **Priority**, **Classification**, **Manual Verdict** | Analyst actions, dashboards, ROI | | Linking (optional) | Case-tracking reference on linked layouts | Sync and after-actions reporting | *** ## Maintaining This Reference | **Step** | **Action** | **Owner** | | -------- | -------------------------------------------------------------------- | --------------------- | | 1 | Export playbook YAML after package upgrades | Engineering / PS | | 2 | Reconcile flow names and sub-playbook steps with this page | Docs + PS | | 3 | Align connector-embedded action names with connector naming standard | Connector team + Docs | | 4 | Update Archbee after tenant-verified changes | Docs | Internal interactive flow maps (for example PS HTML diagrams) can supplement this page but should use customer terminology (**Turbine Schema**, **Case Management**, **CASE-**) when content is promoted here. *** ## Next Steps | **Topic** | **Guide** | | ---------------------------------------- | --------------------------------------------------------------- | | Playbook categories and when to use them | [Playbook Types and Usage](docId\:Np4vvQLU6pnRWzSbEL_EO) | | Conceptual architecture diagrams | [Architecture and Data Flow](docId\:kWCIabPwqOzQcjd2eZtic) | | Configure ingestion templates | [Configure Ingestion Playbooks](docId\:B1-f6uEPZ95dFN5nNl0lA) | | Build routing rule playbooks | [Building Routing Rule Playbooks](docId\:vEiFYG4oYWkQ3DcMMwjXi) | | Analyst first investigation | [Getting Started](docId\:p7QJQUayeKczHPxEpPWcp) | | CASE record layout and Support actions | [Case Management (CASE)](docId\:sDpESfT6Lsyz0zfrn_hok) |