Playbook Types and Usage
AI SOC includes different types of playbooks that serve specific purposes in the investigation workflow. For flow-level triggers, inputs, outputs, and handoffs between playbooks, see Playbook Flow ReferencePlaybook Flow Reference.
Ingestion Playbooks (System-Driven)
These playbooks run automatically to ingest alerts and create Case Management records (tracking prefix CASE-). Playbook titles may still refer to signals or SIG in older bundles.
Ingest Webhook Alert
- Trigger: Webhook sensor receives alert
- Purpose: Receives alerts from webhook sources and creates Case Management records
- When it runs: Automatically when alerts are sent to the webhook endpoint
- Analyst action: None required - runs automatically
Ingest Bulk Alerts
- Trigger: CRON schedule
- Purpose: Pulls alerts in bulk from source systems and creates Case Management records
- When it runs: On a scheduled interval (configured in playbook)
- Analyst action: None required - runs automatically
Ingest Email to SIG Record
- Trigger: Email sensor receives phishing report
- Purpose: Processes phishing emails and creates Case Management records (playbook name may still include SIG)
- When it runs: Automatically when emails are received
- Analyst action: None required - runs automatically
Configuration: These playbooks are configured during setup and typically do not require analyst interaction.
Triage and Verdict Playbooks (Analyst-Triggered or Rule-Driven)
These playbooks support investigation and analysis workflows.
Routing rule playbooks run when a Signal Routing Rules record matches a Case Management record. They use the Rule-Execute flow event, Search Records on the event tracking ID, a verdict component with $actions, and a single flow. The rule UUID condition is added when you apply the rule to the playbook on the routing rule record. Create them from a case (Create a Playbook), in Orchestration, or by duplicating a template. See Building Routing Rule PlaybooksBuilding Routing Rule Playbooks.
AI SOC - Trigger Analysis Agent via Routing Rule (packaged in AI SOC Trigger Analysis Agent SSP)
- Trigger: Rule-Execute when a Signal Routing Rules record matches (you create routing rules post-import; the SSP does not ship a pre-seeded Trigger Analysis Agent routing rule)
- Purpose: Invokes the AI SOC - Trigger Analysis Agent component to run the AI SOC - Trigger Analysis Agent on the matched signal without an analyst clicking Generate Plan or Re-investigate
- When to use: Overnight triage, first-seen alert types, or any signal where you want hands-off first-pass investigation
- How to use: Create a Signal Routing Rules record, associate this playbook, enable the playbook if it is disabled after import, and configure a PAT token assetβsee Building Routing Rule PlaybooksBuilding Routing Rule Playbooks and RBAC Considerations for AI SOCRBAC Considerations for AI SOC
- Analyst action: Review plan, component inputs and outputs, and verdict on the record after the run completes; use Create a Playbook to convert repeatable patterns into investigation playbooks
Alert Triage Playbook Template
- Trigger: Manual execution or routing rule (Rule-Execute flow event when rule-driven)
- Purpose: Runs Hero AI verdict and threat intelligence analysis on a Case Management record
- When to use: When you need refreshed AI analysis or verdict generation
- How to use: Trigger manually from the record, or associate the playbook on a routing rule record
Case correlation (AI SOC - Main)
- Trigger: CRON schedule in AI SOC - Main (default about every 10 minutes)
- Purpose: Correlates the current Case Management record with related records using AI SOC - Get CASE Records to Correlate Against and AI SOC - Correlate Current Case Record
- When it runs: Automatically on the schedule after records leave initial ingestion; not a Case Management Support tab button in the Autonomous SOC v7 package
- Analyst action: Review results in the Correlation area on the record
Run Rule Against Pending Signals
- Trigger: Manual execution from a Routing Rule record
- Purpose: Evaluates the selected routing rule against signals that are pending routing
- When to use: When you need to apply or test a rule against the pending queue
- How to use: Open the Routing Rule record β Support tab β Run Rule Against Pending Signals; expand Records Matched to review matches
Enrichment and Knowledge Playbooks (System-Driven)
These playbooks automatically enrich signals with threat intelligence and knowledge base context.
Enrich Observables
- Trigger: Signal creation or observable extraction
- Purpose: Enriches observables with TI providers and attaches evidence to the signal
- When it runs: Automatically when observables are extracted
- Analyst action: None required - runs automatically
- Configuration: Configure which TI providers to use in the playbook
Link Knowledge Base Articles
- Trigger: Signal creation or correlation
- Purpose: Links relevant KB articles to signals to provide immediate analyst context
- When it runs: Automatically as part of ingestion and correlation
- Analyst action: None required - runs automatically
- Configuration: KB articles are linked based on Matching Values and correlation logic
Escalation and Resolution (Automated)
Pending CASE resolution and related flows (names depend on your installed package) run after threat intelligence and evaluation complete. They may set Status to Escalated, Closed, or New using AI verdict, confidence, and thresholds your administrator configures in Orchestration β Playbooks.
- Trigger: Automatic when flow conditions are met (varies by tenant)
- Purpose: Apply consistent outcomes and prioritization on Case Management records without a separate manual βescalateβ control
- Analyst action: Continue investigation on the same record; use Support tab actions (for example Run Rules Engine) when your process requires a refresh