Playbook Types and Usage
AI SOC includes different types of playbooks that serve specific purposes in the investigation workflow. For flow-level triggers, inputs, outputs, and handoffs between playbooks, see Playbook Flow Referenceο»Ώ.
Ingestion Playbooks (System-Driven)
These playbooks run automatically to ingest alerts and create Case Management records (tracking prefix CASE-). Playbook titles may still refer to signals or SIG in older bundles.
Ingest Webhook Alert
- Trigger: Webhook sensor receives alert
- Purpose: Receives alerts from webhook sources and creates Case Management records
- When it runs: Automatically when alerts are sent to the webhook endpoint
- Analyst action: None required - runs automatically
Ingest Bulk Alerts
- Trigger: CRON schedule
- Purpose: Pulls alerts in bulk from source systems and creates Case Management records
- When it runs: On a scheduled interval (configured in playbook)
- Analyst action: None required - runs automatically
Ingest Email to CASE Record (Event)
- Trigger: Email sensor receives a phishing report
- Purpose: Processes phishing emails and creates Case Management records
- When it runs: Automatically when emails are received
- Analyst action: None required. It runs automatically
Ingest Webhook Email
- Trigger: Webhook sensor Test Email Ingestion (AI SOC)
- Purpose: Receives a test email and forwards it to the email ingestion flow
- When it runs: When a test email is posted to that webhook
- Analyst action: None required. It runs automatically
- Related playbook: AI SOC - Test Email Ingestion (Webhook)
Configuration: These playbooks are configured during setup and typically do not require analyst interaction.
Triage and Verdict Playbooks (Analyst-Triggered or Rule-Driven)
These playbooks support investigation and analysis workflows.
Routing rule playbooks run when a Signal Routing Rules record matches a Case Management record. They use the Rule-Execute flow event, Search Records on the event tracking ID, a verdict component with $actions, and a single flow. The rule UUID condition is added when you apply the rule to the playbook on the routing rule record. Create them from a case (Create a Playbook), in Orchestration, or by duplicating a template. See Building Routing Rule Playbooksο»Ώ.
AI SOC - Trigger Analysis Agent via Routing Rule (packaged in AI SOC Trigger Analysis Agent SSP)
- Trigger: Rule-Execute when a Signal Routing Rules record matches (you create routing rules post-import; the SSP does not ship a pre-seeded Trigger Analysis Agent routing rule)
- Purpose: Invokes the AI SOC - Trigger Analysis Agent component to run the AI SOC - Trigger Analysis Agent on the matched signal without an analyst clicking Generate Investigation Plan or Re-investigate
- When to use: Overnight triage, first-seen alert types, or any signal where you want hands-off first-pass investigation
- How to use: Create a Signal Routing Rules record, associate this playbook, enable the playbook if it is disabled after import, and configure a PAT token assetβsee Building Routing Rule Playbooksο»Ώ and RBAC Considerations for AI SOCο»Ώ
- Analyst action: Review plan, component inputs and outputs, and verdict on the record after the run completes; use Create a Playbook to convert repeatable patterns into investigation playbooks
Alert Triage Playbook Template
- Trigger: Manual execution or routing rule (Rule-Execute flow event when rule-driven)
- Purpose: Runs Hero AI verdict and threat intelligence analysis on a Case Management record
- When to use: When you need refreshed AI analysis or verdict generation
- How to use: Trigger manually from the record, or associate the playbook on a routing rule record
Case Correlation (Time Delay)
- Trigger: The Case Correlation Date/Time on the Case Management record
- Purpose: Correlates the current record with related records
- When it runs: When that Date/Time is reached, and only when Date/Time Field Trigger is enabled. It is not a button on the record. With that feature turned off, the playbook stays idle and the record shows no error
- Analyst action: Review results in the Correlated Cases widget on Case Investigation
Run Rule Against Pending Signals
- Trigger: Manual execution from a Routing Rule record
- Purpose: Evaluates the selected routing rule against signals that are pending routing
- When to use: When you need to apply or test a rule against the pending queue
- How to use: Open the Routing Rule record β Support tab β Run Rule Against Pending Signals; expand Records Matched to review matches
Enrichment and Knowledge Playbooks (System-Driven)
These playbooks automatically enrich signals with threat intelligence and knowledge base context.
Enrich Observables
- Trigger: Signal creation or observable extraction
- Purpose: Enriches observables with TI providers and attaches evidence to the signal
- When it runs: Automatically when observables are extracted
- Analyst action: None required - runs automatically
- Configuration: Configure which TI providers to use in the playbook
Link Knowledge Base Articles
- Trigger: Signal creation or correlation
- Purpose: Links relevant KB articles to signals to provide immediate analyst context
- When it runs: Automatically as part of ingestion and correlation
- Analyst action: None required - runs automatically
- Configuration: KB articles are linked based on Matching Values and correlation logic
Escalation and Resolution (Automated)
Pending CASE Resolution (Automated) runs after the AI verdict or its confidence changes. It reads Confidence Thresholds on AI SOC General Configuration. A Malicious or Suspicious verdict at or above the threshold sets Requires Attention, and sets Status to Escalated when the case is Processing, New, or Error. A Benign verdict at or above the threshold sets Status to Closed. A newly assigned verdict sets Status to New.
- Trigger: Automatic when flow conditions are met (varies by tenant)
- Purpose: Apply consistent outcomes and prioritization on Case Management records without a separate manual βescalateβ control
- Analyst action: Continue investigation on the same record; use Support tab actions (for example Run Rules Engine) when your process requires a refresh
Remediation Actions
Manual Remediation on Case Investigation runs these playbooks: Observable Remediation - Block, Observable Remediation - Unblock, User Account - Block, User Account - Unblock, Revoke Access Tokens, Isolate Host, and Release Host. This package does not include CrowdStrike or Microsoft Defender assets.