---
title: Playbook Types and Usage
slug: solutions/playbook-types-and-usage
docTags: 
createdAt: 2026-03-04T10:51:28.538Z
---

AI SOC includes different types of playbooks that serve specific purposes in the investigation workflow. For flow-level triggers, inputs, outputs, and handoffs between playbooks, see [Playbook Flow Reference](docId\:ZLfIPKIHFJKNqGcHW7Sxb).

### Ingestion Playbooks (System-Driven)

These playbooks run automatically to ingest alerts and create **Case Management** records (tracking prefix **CASE-**). Playbook titles may still refer to signals or SIG in older bundles.

**Ingest Webhook Alert**

- **Trigger:** Webhook sensor receives alert
- **Purpose:** Receives alerts from webhook sources and creates **Case Management** records
- **When it runs:** Automatically when alerts are sent to the webhook endpoint
- **Analyst action:** None required - runs automatically

**Ingest Bulk Alerts**

- **Trigger:** CRON schedule
- **Purpose:** Pulls alerts in bulk from source systems and creates **Case Management** records
- **When it runs:** On a scheduled interval (configured in playbook)
- **Analyst action:** None required - runs automatically

**Ingest Email to SIG Record**

- **Trigger:** Email sensor receives phishing report
- **Purpose:** Processes phishing emails and creates **Case Management** records (playbook name may still include **SIG**)
- **When it runs:** Automatically when emails are received
- **Analyst action:** None required - runs automatically

**Configuration:** These playbooks are configured during setup and typically do not require analyst interaction.

### Triage and Verdict Playbooks (Analyst-Triggered or Rule-Driven)

These playbooks support investigation and analysis workflows.

**Routing rule playbooks** run when a **Signal Routing Rules** record matches a **Case Management** record. They use the **Rule-Execute** flow event, **Search Records** on the event **tracking ID**, a **verdict** component with `$actions`, and a **single flow**. The **rule UUID** condition is added when you apply the rule to the playbook on the routing rule record. Create them from a case (**Create a Playbook**), in **Orchestration**, or by duplicating a template. See [Building Routing Rule Playbooks](docId\:vEiFYG4oYWkQ3DcMMwjXi).

**AI SOC - Trigger Analysis Agent via Routing Rule** (packaged in **AI SOC Trigger Analysis Agent** SSP)

- **Trigger:** **Rule-Execute** when a **Signal Routing Rules** record matches (you create routing rules post-import; the SSP does not ship a pre-seeded Trigger Analysis Agent routing rule)
- **Purpose:** Invokes the **AI SOC - Trigger Analysis Agent** component to run the **AI SOC - Trigger Analysis Agent** on the matched signal without an analyst clicking **Generate Plan** or **Re-investigate**
- **When to use:** Overnight triage, first-seen alert types, or any signal where you want hands-off first-pass investigation
- **How to use:** Create a **Signal Routing Rules** record, associate this playbook, enable the playbook if it is disabled after import, and configure a **PAT token** asset—see [Building Routing Rule Playbooks](docId\:vEiFYG4oYWkQ3DcMMwjXi) and [RBAC Considerations for AI SOC](docId\:Jl6Dsw0QjBkPq_iOJDgLp)
- **Analyst action:** Review plan, component inputs and outputs, and verdict on the record after the run completes; use **Create a Playbook** to convert repeatable patterns into **investigation playbooks**

**Alert Triage Playbook Template**

- **Trigger:** Manual execution or routing rule (**Rule-Execute** flow event when rule-driven)
- **Purpose:** Runs Hero AI verdict and threat intelligence analysis on a **Case Management** record
- **When to use:** When you need refreshed AI analysis or verdict generation
- **How to use:** Trigger manually from the record, or associate the playbook on a routing rule record

**Case correlation (AI SOC - Main)**

- **Trigger:** CRON schedule in **AI SOC - Main** (default about every 10 minutes)
- **Purpose:** Correlates the current **Case Management** record with related records using **AI SOC - Get CASE Records to Correlate Against** and **AI SOC - Correlate Current Case Record**
- **When it runs:** Automatically on the schedule after records leave initial ingestion; not a **Case Management** **Support** tab button in the Autonomous SOC v7 package
- **Analyst action:** Review results in the **Correlation** area on the record

**Run Rule Against Pending Signals**

- **Trigger:** Manual execution from a **Routing Rule** record
- **Purpose:** Evaluates the selected routing rule against signals that are pending routing
- **When to use:** When you need to apply or test a rule against the pending queue
- **How to use:** Open the **Routing Rule** record → **Support** tab → **Run Rule Against Pending Signals**; expand **Records Matched** to review matches

### Enrichment and Knowledge Playbooks (System-Driven)

These playbooks automatically enrich signals with threat intelligence and knowledge base context.

**Enrich Observables**

- **Trigger:** Signal creation or observable extraction
- **Purpose:** Enriches observables with TI providers and attaches evidence to the signal
- **When it runs:** Automatically when observables are extracted
- **Analyst action:** None required - runs automatically
- **Configuration:** Configure which TI providers to use in the playbook

**Link Knowledge Base Articles**

- **Trigger:** Signal creation or correlation
- **Purpose:** Links relevant KB articles to signals to provide immediate analyst context
- **When it runs:** Automatically as part of ingestion and correlation
- **Analyst action:** None required - runs automatically
- **Configuration:** KB articles are linked based on Matching Values and correlation logic

### Escalation and Resolution (Automated)

**Pending CASE resolution** and related flows (names depend on your installed package) run after threat intelligence and evaluation complete. They may set **Status** to **Escalated**, **Closed**, or **New** using AI verdict, confidence, and thresholds your administrator configures in **Orchestration** → **Playbooks**.

- **Trigger:** Automatic when flow conditions are met (varies by tenant)
- **Purpose:** Apply consistent outcomes and prioritization on **Case Management** records without a separate manual “escalate” control
- **Analyst action:** Continue investigation on the same record; use **Support** tab actions (for example **Run Rules Engine**) when your process requires a refresh