Run the Ingestion Process

Use this mode to build a complete alert ingestion component for a specific vendor. It combines the HTTP API calls that fetch raw alerts with Hero AI–assisted mapping of raw alert data to the Turbine Schema — producing a single reusable component for downstream playbooks.

You can run the ingestion process in three ways. Under Generate Ingestion component/playbook using: choose one of:

Flow 1: Ingestion using previously created components — Choose Existing components and use components you already have in Turbine; then test the API calls and complete mapping (see Flow 1Flow 1 below).

Flow 2: Ingestion using API Specification — Choose API specification and follow all steps (provide spec, get API sequence, configure auth, test, map to Turbine Schema). See Flow 2Flow 2 below.

Flow 3: Ingestion using Webhooks — Choose Webhook and use a sample alert payload to generate schema mapping and a webhook-based playbook. See Flow 3: Ingestion using WebhooksFlow 3: Ingestion using Webhooks at the bottom of this section.

The Route to AI SOC toggle (when generating a playbook or ingestion component) applies to all three flows. Turn it on if you want the Turbine Schema object produced by the ingestion flow to be sent automatically to the Case Management application in AI SOC.

Flow 1: Ingestion using previously created components

When you use components that already exist in Turbine, under Generate Ingestion component/playbook using: choose Existing components. Then follow these steps:

Step 1: Select Existing Components

Select existing components that retrieve alert data. From the Component dropdown, choose the component(s) you need, then select Continue.

Step 2: Sequence and Execute Components

Arrange components in the right execution order, run them sequentially, and trigger data flow between components.

Use the drag handle to reorder components if you have more than one.

For each component, select Run to execute it and view the output in the interface. Use Open component to open the component in a separate view.

If the API call needs headers, query parameters, or a request body, select Edit to open Configure Parameters. Enter or edit headers, query parameters, and request body (JSON), select Update to save, then run the component from the main view.

Upon a successful run, click Link to automatically map and transfer the output parameters from the previous API call into the input fields of the next API call in your sequence.

Continue until you have run the sequence and the final component returns the raw alert data you need for mapping. Then select Continue.

Next steps: Complete Map to the Turbine Schema (part of Step 4Step 4 in Flow 2), Run the Ingestion ProcessStep 5: Configuring the Ingestion Component, and Step 6: Review the OutputStep 6: Review the Output to create the final ingestion component.

Authentication is already configured for the selected components, so you do not configure authentication in this flow.

Flow 2: Ingestion Using API Specification

Follow all steps below when you choose API specification under Generate Ingestion component/playbook using: to build the ingestion component from an OpenAPI spec.

Step 1: API Specification

Upload or paste an OpenAPI spec to discover available endpoints.

In the API Specification area, paste your API/Swagger specification (JSON or YAML) or use Choose File to upload a file.

Optionally check Skip deprecated endpoints.

Select Parse OpenAPI Spec to discover endpoints.

Step 2: Get API Sequence

Select or generate the sequence of API calls required to retrieve alerts from the vendor product.

Manually select endpoints — The widget lists endpoints (after parsing in Step 1). Select the checkboxes for the endpoints you need. You can select up to 25 endpoints; once this limit is reached, the remaining checkboxes are disabled. Then select Continue.

Use Hero AI — Hero AI generates the API call sequence. Optionally add a custom prompt in the text area (for example, Add an Optional custom prompt to guide Hero AI in generating the API sequence...). Select Get API Sequence using Hero AI, then Continue.

If the spec has not been parsed yet, the widget shows Please parse the OpenAPI spec first to see available endpoints.

Step 3: Authentication Configuration

Set up the authentication required to access the vendor API.

Enter API Endpoint Base URL (for example, https://api.crowdstrike.com/).

Under Authentication Type, choose one: None (no authentication needed), API Key, Bearer Token, Basic Auth, or OAuth 2.0. Create a new HTTP asset or select an existing one and configure credentials as needed.

Select Continue.

Step 4: Sequence and Execute Components and Map to the Turbine Schema

Sequence and execute components

Arrange the API call components in the right execution order, run them sequentially, and trigger data flow between components.

Use the drag handle to reorder components if you have more than one.

For each component, select Run to execute it and view the output in the interface. Use Open component to open the component in a separate view.

If the API call needs headers, query parameters, or a request body, select Edit to open Configure Parameters. Enter or edit headers, query parameters, and request body (JSON), select Update to save, then run the component from the main view.

Continue until you have run the sequence and the final component returns the raw alert data you need for mapping. Then select Continue.

Step 5: Configuring the Ingestion Component

Define Component Prefix Name

Enter a unique prefix to identify the generated component (for example, CRWD).

The prefix is limited to a maximum of 10 characters. This prefix is prepended to the name of the new component and all associated actions generated by this flow.

Configure Hero AI Governance

Visible to Hero AI: It is highly recommended to toggle this ON. This allows Hero AI to discover and utilize this component in other automated workflows and use cases across the platform.

Requires confirmation to execute in chat: This setting ensures that any execution initiated by the AI within a chat session requires explicit human approval before running.

Enable Route to AI SOC

Toggle this ON to automatically send the Turbine Schema formatted alert output to the AI SOC solution.

Finalize Generation

Once all settings are verified, click the Create Component button. Your new ingestion component will be built and added to your Content library, ready to begin processing alerts.

Step 6: Review the Output

The completed ingestion component includes:

The HTTP actions that fetch raw alerts from the vendor API.

A predefined component that maps the incoming raw alert to the Turbine Schema (for example AI SOC-Alerts to Turbine Schema). Hero uses the Turbine Schema as the mapping target; the widget does not display or export a JSONata transform, and that transform is not part of the generated output.

If Route to AI SOC is enabled, an Emit Event action is automatically added so the standardized Turbine Schema alerts are sent to AI SOC for triage and remediation.

The component is named VendorName: Ingestion_Component (for example, CrowdStrike_Ingestion_Component) and is ready to use in AI SOC alert ingestion playbooks.

To discard your progress and start over, select Start from beginning.

Flow 3: Ingestion using Webhooks

This flow uses the Webhook Ingestion Playbook Creator to turn raw vendor alert data (delivered via webhook) into standardized Swimlane records. The creator builds a canvas playbook that: receives the webhook payload → creates a raw alerts array → parses alerts in bulk → extends each alert to the Turbine Schema → emits each Turbine Schema object (for example to the Case Management application when Route to AI SOC is on).

You may be prompted for a sample alert payload and schema mapping earlier in the widget; complete those as needed. Then configure the playbook and webhook as follows.

Step 1: Configure the ingestion playbook

Enter a Playbook Prefix Name (for example, "Fortinet" or "CrowdStrike").

Turn the Route to AI SOC toggle on if you want the Turbine Schema object from this flow to be sent automatically to the Case Management application in AI SOC. (This toggle applies to all three ingestion flows.)

Click Create Playbook.

You receive a Playbook Link and a Webhook URL to give to your vendor.

Step 2: Configure the vendor webhook

Copy the Webhook URL from the previous step.

In your vendor platform (for example, firewall, EDR, SIEM), open the webhook or API integration settings.

Paste the URL so the vendor can POST alert data to it when events occur.

Testing the webhook (optional) — You can POST a sample alert to the webhook URL (for example, with a REST client or curl). In Case Management, open Signal Trace to confirm the alert was ingested and that the signal data and Turbine Schema fields are populated correctly.