---
title: Run the Ingestion Process
slug: solutions/run-the-ingestion-process
docTags: 
createdAt: 2026-03-04T10:45:19.125Z
---

Use this mode to build a complete alert ingestion component for a specific vendor. It combines the HTTP API calls that fetch raw alerts with Hero AI–assisted mapping of raw alert data to the Turbine Schema — producing a single reusable component for downstream playbooks.

You can run the ingestion process in three ways. Under **Generate Ingestion component/playbook using:** choose one of:

- **Flow 1: Ingestion using previously created components** — Choose **Existing components** and use components you already have in Turbine; then test the API calls and complete mapping (see [Flow 1](docId:0p9Qwz3o-0J5DNkPJUGmq) below).
- **Flow 2: Ingestion using API Specification** — Choose **API specification** and follow all steps (provide spec, get API sequence, configure auth, test, map to Turbine Schema). See [Flow 2](docId:0p9Qwz3o-0J5DNkPJUGmq) below.
- **Flow 3: Ingestion using Webhooks** — Choose **Webhook** and use a sample alert payload to generate schema mapping and a webhook-based playbook. See [Flow 3: Ingestion using Webhooks](docId:0p9Qwz3o-0J5DNkPJUGmq) at the bottom of this section.

:::hint{type="info"}
The **Route to AI SOC **toggle (when generating a playbook or ingestion component) applies to **all three flows**. Turn it on if you want the Turbine Schema object produced by the ingestion flow to be sent automatically to the **Case Management** application in AI SOC.
:::

## Flow 1: Ingestion using previously created components

When you use components that already exist in Turbine, under **Generate Ingestion component/playbook using:** choose **Existing components**. Then follow these steps:

### Step 1: Select Existing Components

Select existing components that retrieve alert data. From the **Component** dropdown, choose the component(s) you need, then select **Continue**.

### Step 2: Sequence and Execute Components

Arrange components in the right execution order, run them sequentially, and trigger data flow between components.

- Use the drag handle to reorder components if you have more than one.
- For each component, select **Run** to execute it and view the output in the interface. Use **Open component** to open the component in a separate view.
- If the API call needs headers, query parameters, or a request body, select **Edit** to open **Configure Parameters**. Enter or edit headers, query parameters, and request body (JSON), select **Update** to save, then run the component from the main view.
- Upon a successful run, click **Link **to automatically map and transfer the output parameters from the previous API call into the input fields of the next API call in your sequence.
- Continue until you have run the sequence and the final component returns the raw alert data you need for mapping. Then select **Continue**.

**Next steps: **Complete **Map to the Turbine Schema **(part of [Step 4](docId\:OGtyoyW_oUmQXrbEofW4a) in Flow 2), [Run the Ingestion Process](docId\:OGtyoyW_oUmQXrbEofW4a), and [Step 6: Review the Output](docId\:OGtyoyW_oUmQXrbEofW4a) to create the final ingestion component.

Authentication is already configured for the selected components, so you do not configure authentication in this flow.

## Flow 2: Ingestion Using API Specification

Follow all steps below when you choose **API specification** under **Generate Ingestion component/playbook using:** to build the ingestion component from an OpenAPI spec.

### Step 1: API Specification

Upload or paste an OpenAPI spec to discover available endpoints.

1. In the **API Specification** area, paste your API/Swagger specification (JSON or YAML) or use **Choose File** to upload a file.
2. Optionally check **Skip deprecated endpoints**.
3. Select **Parse OpenAPI Spec** to discover endpoints.

### Step 2: Get API Sequence

Select or generate the sequence of API calls required to retrieve alerts from the vendor product.

- **Manually select endpoints** — The widget lists endpoints (after parsing in Step 1). Select the checkboxes for the endpoints you need. You can select up to 25 endpoints; once this limit is reached, the remaining checkboxes are disabled. Then select **Continue**.
- **Use Hero AI** — Hero AI generates the API call sequence. Optionally add a custom prompt in the text area (for example, *Add an Optional custom prompt to guide Hero AI in generating the API sequence...*). Select **Get API Sequence using Hero AI**, then **Continue**.

If the spec has not been parsed yet, the widget shows *Please parse the OpenAPI spec first to see available endpoints.*

### Step 3: Authentication Configuration

Set up the authentication required to access the vendor API.

1. Enter **API Endpoint Base URL** (for example, https\://api.crowdstrike.com/).
2. Under **Authentication Type**, choose one: **None** (no authentication needed), **API Key**, **Bearer Token**, **Basic Auth**, or **OAuth 2.0**. Create a new HTTP asset or select an existing one and configure credentials as needed.
3. Select **Continue**.

### Step 4: Sequence and Execute Components and Map to the Turbine Schema

**Sequence and execute components**

Arrange the API call components in the right execution order, run them sequentially, and trigger data flow between components.

- Use the drag handle to reorder components if you have more than one.
- For each component, select **Run** to execute it and view the output in the interface. Use **Open component** to open the component in a separate view.
- If the API call needs headers, query parameters, or a request body, select **Edit** to open **Configure Parameters**. Enter or edit headers, query parameters, and request body (JSON), select **Update** to save, then run the component from the main view.
- Continue until you have run the sequence and the final component returns the raw alert data you need for mapping. Then select **Continue**.

### Step 5: Configuring the Ingestion Component

**Define Component Prefix Name**

- Enter a unique prefix to identify the generated component (for example, CRWD).

:::hint{type="info"}
The prefix is limited to a maximum of 10 characters. This prefix is prepended to the name of the new component and all associated actions generated by this flow.
:::

**Configure Hero AI Governance**

- **Visible to Hero AI:** It is highly recommended to toggle this ON. This allows Hero AI to discover and utilize this component in other automated workflows and use cases across the platform.
- **Requires confirmation to execute in chat:** This setting ensures that any execution initiated by the AI within a chat session requires explicit human approval before running.

**Enable Route to AI SOC**

- Toggle this ON to automatically send the Turbine Schema formatted alert output to the AI SOC solution.

**Finalize Generation**

- Once all settings are verified, click the **Create Component** button. Your new ingestion component will be built and added to your Content library, ready to begin processing alerts.

### Step 6: Review the Output

The completed ingestion component includes:

- The HTTP actions that fetch raw alerts from the vendor API.
- A predefined component that maps the incoming raw alert to the Turbine Schema (for example **AI SOC-Alerts to Turbine Schema**). Hero uses the Turbine Schema as the mapping target; the widget does not display or export a JSONata transform, and that transform is not part of the generated output.
- If **Route to AI SOC** is enabled, an **Emit Event** action is automatically added so the standardized Turbine Schema alerts are sent to AI SOC for triage and remediation.

The component is named *VendorName*: Ingestion\_Component (for example, CrowdStrike\_Ingestion\_Component) and is ready to use in AI SOC alert ingestion playbooks.

To discard your progress and start over, select **Start from beginning**.

## Flow 3: Ingestion using Webhooks

This flow uses the **Webhook Ingestion Playbook Creator** to turn raw vendor alert data (delivered via webhook) into standardized Swimlane records. The creator builds a canvas playbook that: receives the webhook payload → creates a raw alerts array → parses alerts in bulk → extends each alert to the Turbine Schema → emits each Turbine Schema object (for example to the **Case Management** application when **Route to AI SOC** is on).

You may be prompted for a sample alert payload and schema mapping earlier in the widget; complete those as needed. Then configure the playbook and webhook as follows.

### Step 1: Configure the ingestion playbook

1. Enter a **Playbook Prefix Name** (for example, "Fortinet" or "CrowdStrike").
2. Turn the **Route to AI SOC** toggle **on** if you want the Turbine Schema object from this flow to be sent automatically to the **Case Management** application in AI SOC. (This toggle applies to all three ingestion flows.)
3. Click **Create Playbook**.
4. You receive a **Playbook Link** and a **Webhook URL** to give to your vendor.

### Step 2: Configure the vendor webhook

1. Copy the **Webhook URL** from the previous step.
2. In your vendor platform (for example, firewall, EDR, SIEM), open the webhook or API integration settings.
3. Paste the URL so the vendor can **POST** alert data to it when events occur.

**Testing the webhook (optional)** — You can POST a sample alert to the webhook URL (for example, with a REST client or curl). In **Case Management**, open **Signal Trace** to confirm the alert was ingested and that the signal data and Turbine Schema fields are populated correctly.