--- title: Troubleshooting slug: solutions/troubleshooting docTags: createdAt: 2026-02-24T08:23:12.164Z --- This guide helps you diagnose and resolve common issues in AI SOC. Each section includes symptoms, root causes, and step-by-step solutions. Use the preventive measures to avoid issues before they occur. ## Quick Reference: Common Issues | **Issue** | **Category** | **Quick Fix** | | ------------------------------------------------------------------------- | -------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------ | | Generate Plan button missing | Hero AI | Feature flag not enabled — button will not appear until Hero AI is enabled for tenant | | Generate Plan button does nothing | Hero AI | Verify Hero AI enabled; check RBAC and widget config | | Plan generation times out | Hero AI | Check service availability, retry | | Missing components in generated playbook | Browser | Allow pop-ups for Swimlane domain | | Conflicting playbook changes after save | Browser / Automation | Close extra builder windows; edit from one session — see **Conflicting Changes from Multiple Playbook Builder Sessions** | | Recovery steps missing from generated playbook | Automation | Expected: use reusable recovery playbooks after containment; see **Recovery Steps Missing from Auto-Generated Playbook** | | Marketplace shows Install but content exists | Installation | Promoted/imported content may be **User Content**; see Installing — Swimlane Content and Marketplace | | Threat intelligence shows "error" status | Threat Intelligence | Verify provider credentials | | No steps appear in investigation plan | Signal Data | Ensure observables exist on signal | | Playbook execution fails | Playbooks | Check component dependencies | | Routing rule matches but playbook does not run | Automation | Verify Rule-Execute trigger, Rule-UUID condition, single flow, verdict component — see **Investigation Playbook Does Not Run** | | No default routing rule after SSP import | Automation | Expected — create a **Signal Routing Rule** post-import; see [Getting Started — Enable Agentic Investigation After Import](docId:) | | New triage rule order is above catch-all (for example 100000 after 99999) | Automation | Catch-all must use **AI SOC - Trigger Analysis Agent via Routing Rule** — see **New Triage Rules Get Rule Order Above the Catch-All** | | Re-investigate button missing or disabled | Hero AI / Widget | Confirm Hero AI is enabled; set **Analysis Mode** to **Autonomous**; record must leave **Processing**; check widget RBAC and **Analysis Status** | | Re-investigate removed prior investigation data | Autonomous / Widget | Expected after confirm — update KBAs before re-run if you need new agent guidance | | Agent Investigation shows **Not Started** only | Autonomous / Ingest | Wait for enrichment to complete; click **Re-investigate** after record leaves **Processing** | | Regenerate Plan or Recreate Playbook disabled | Hero AI | Requires an existing investigation plan; wait for generation to finish | | Signals not being ingested | Ingestion | Validate sensor and playbook configuration | ## Signal Status Issues ### Signal Stuck in Processing **Symptoms:** - Signal **Status** remains **Processing** for a long time (longer than expected after ingestion) - **Generate Plan** is not available or the signal never moves to New, Closed, or Escalated **Root causes:** - Threat intelligence enrichment has not completed (providers slow, errors, or observables not yet enriched) - Signal evaluation automation (correlation, KB linking, Hero AI analysis) has not finished or failed - The pending signal resolution flow has not run or encountered an error **Resolution:** 1. **Check Threat Intelligence Status** on the signal. If enrichments are still pending, wait for them to complete or verify TI provider assets and connectivity. 2. **Check flow run history** in **Orchestration** → **Playbooks** for the signal evaluation and pending signal resolution flows. Look for failed or stuck runs and retry or fix the underlying cause. 3. **Verify correlation and Hero AI** are running. Correlation runs on a schedule; Hero AI analysis runs as part of signal evaluation. If Hero AI is disabled or failing, the signal may remain in Processing until those steps complete or timeout. 4. If the record is truly stuck (all steps completed but status never updated), open the **Support** tab on the **Case Management** record and run **AI Case Analysis**, **Check Threat Intelligence Results**, or **Run Rules Engine** as appropriate, or contact your administrator to inspect the pending signal resolution flow. **Prevention:** - Ensure threat intelligence providers are configured and responding (see **Installation and Configuration**). - Monitor flow run history for repeated failures on signal evaluation or pending signal resolution. ## Hero AI Service Issues Hero AI powers plan generation, verdict analysis, and playbook creation. These issues typically relate to service availability, authentication, or configuration. ### Generate Plan Button Missing or Does Nothing **Symptoms:** - **Generate Plan** button does not appear at all (when Hero AI feature flag is not enabled) - Or: clicking **Generate Plan** shows no response, no loading indicator, no error; plan section remains empty **Root Causes:** - **Hero AI feature flag is not enabled for your tenant** — in this case the **Generate Plan** button will not appear in the UI. Enablement is required before the button is shown. - Hero AI is not enabled for your account or tenant (button may be hidden or non-functional) - Required Signal fields are missing - AI Alert Analysis panel is not visible or configured (for example, RBAC hides the button or section) - Browser console shows authentication errors **Resolution:** 1. **Verify Hero AI is enabled:** - Contact your system administrator to confirm Hero AI Premium is enabled - Check that your account has access to Hero AI features - Verify the feature flag is active for your tenant 2. **Check Signal record configuration:** - Ensure the Signal record has required fields populated (observables, signal source, etc.) - Verify the AI Alert Analysis panel is visible in the Signal record layout - Confirm you have appropriate permissions to view and use Hero AI features 3. **Review browser console:** - Open browser developer tools (F12) - Check the Console tab for authentication or API errors - Look for messages indicating Hero AI service unavailability 4. **Test Hero AI connectivity:** - Try generating a plan on a different signal - Verify network connectivity to Hero AI services - Check if other Hero AI features (like chat) are working **Prevention:** - Confirm Hero AI setup during initial AI SOC installation - Regularly verify Hero AI service status with your administrator - Keep browser and Swimlane platform updated ### Plan Generation Times Out or Fails **Symptoms:** - **Generate Plan** shows a loading indicator but never completes - Error message: "The request to Hero AI timed out" - Plan generation fails after several minutes - Intermittent failures on some signals but not others **Root Causes:** - Hero AI service is experiencing high load or rate limiting - Signal data is too large or complex - Network connectivity issues - Model unavailability or throttling **Resolution:** 1. **Retry the operation:** - Wait 30-60 seconds and click **Generate Plan** again - Hero AI automatically retries on transient failures - Rate limits typically resolve within a few minutes 2. **Check signal complexity:** - Signals with extremely large evidence sets may timeout - Try generating a plan on a simpler signal to verify service is working - Consider breaking down very complex signals 3. **Verify service status:** - Check with your administrator if Hero AI services are experiencing issues - Review system status pages or notifications - Confirm no scheduled maintenance is in progress 4. **Review error details:** - Check the browser console for specific error messages - Look for rate limit indicators (429 status codes) - Note any model unavailability messages **Prevention:** - Avoid generating multiple plans simultaneously - Monitor Hero AI service status during peak usage - Implement retry logic in custom playbooks that call Hero AI ### Hero AI Returns Low Confidence or Unexpected Verdicts **Symptoms:** - Verdict confidence is consistently low (0-3 on 0-10 scale) - Verdicts do not match expected outcomes - Analysis summary mentions "insufficient data" - Improvement suggestions always request more data **Root Causes:** - Signal lacks sufficient observables or evidence - Knowledge Base Articles are missing or incomplete - Threat intelligence enrichment hasn't completed - Similar signals history is unavailable **Resolution:** 1. **Enrich signal data:** - Ensure observables are extracted and present on the signal - Wait for threat intelligence enrichment to complete - Verify Knowledge Base Articles are linked to the signal 2. **Review signal completeness:** - Check that all relevant evidence panels are populated - Verify correlation has run to find similar signals - Ensure investigation comments or summaries are added 3. **Improve Knowledge Base:** - Create or update Knowledge Base Articles for common scenarios - Link relevant KB articles to signals before generating verdicts - Ensure KB articles contain actionable guidance 4. **Check historical context:** - Verify similar signals exist and have verdicts - Ensure resolved signals have manual verdicts set - Review correlation settings to ensure similar signals are found **Prevention:** - Maintain comprehensive Knowledge Base Articles - Regularly review and update KB articles based on investigation outcomes - Ensure threat intelligence enrichment completes before verdict generation - Set manual verdicts on resolved signals to improve future analysis ### Plan Builder Suggests Components from Other Solutions (known issue) **Symptoms:** - Hero AI’s plan builder suggests components that are purpose-built for another solution (for example, the classic SOC solution) - A suggested component may not be the right tool for the investigation step (for example, it does not produce the expected output) - This mainly affects tenants where both the SOC solution and AI SOC are installed **Cause:** - Hero AI reviews all tools available in the tenant and can suggest any of them. The platform does not currently segregate components by solution, so components from the SOC solution can appear in AI SOC plan suggestions. **Workaround:** - Always review the tools Hero AI suggests for each step. If a suggested component is not appropriate (for example, it is built for another solution or does not fit the step), select a different component from the other available tools in the tenant. You can change the suggested component before creating or running the playbook. ## Browser and UI Issues ### Playbook Creation Missing Components (Pop-up Blocker) **Symptoms:** - After clicking **Create Playbook** from the plan, the playbook is created - The generated playbook does not include components suggested in the plan builder - Some or all recommended components are missing - Playbook appears incomplete compared to the plan **Root Causes:** - Browser pop-up blocker is preventing required windows from opening - Pop-ups are blocked for the Swimlane domain - Browser security settings are too restrictive **Resolution:** 1. **Allow pop-ups for Swimlane:** - **Chrome/Edge:** Click the pop-up blocked icon in the address bar → Select "Always allow pop-ups from \[your Swimlane domain]" - **Firefox:** Click the pop-up blocked notification → Select "Allow pop-ups for \[your Swimlane domain]" - **Safari:** Go to Safari → Settings → Websites → Pop-up Windows → Set your Swimlane domain to "Allow" 2. **Retry playbook creation:** - After allowing pop-ups, delete the incomplete playbook if created - Return to the Signal record and click **Create Playbook** again - Verify all suggested components are now included 3. **Verify pop-up settings:** - Test by clicking **Create Playbook** and confirming a new window/tab opens - Check browser settings to ensure Swimlane domain is in allowed list - Clear browser cache if pop-ups still do not work **Prevention:** - Add your Swimlane domain to browser's allowed pop-up list during initial setup - Document pop-up requirements in user onboarding materials - Test playbook creation workflow after browser updates ### Conflicting Changes from Multiple Playbook Builder Sessions **Symptoms:** - Multiple playbook builder windows or tabs are open for the same playbook - You clicked **Create a Playbook** or **Recreate Playbook** more than once from **Automation** - The playbook content after save does not match what you expected, or earlier edits appear lost **Root cause:** - Turbine does **not** lock a playbook when the same user opens it in multiple browser tabs or windows. This is general orchestration behavior (not specific to AI SOC). Each session can save independently; the last save can overwrite changes from another session. **Resolution:** 1. Close all but one builder window for the playbook. 2. In the remaining session, review the canvas and save when the content is correct. 3. Before you click **Create a Playbook** or **Recreate Playbook** again, confirm no other builder window for that playbook is still open. 4. If you need a clean baseline, open the playbook once from **Orchestration** → **Playbooks** and edit from a single tab. **Prevention:** - Click **Recreate Playbook** only once per plan refresh. - Allow pop-ups for your Swimlane domain so the builder opens reliably the first time (see **Playbook Creation Missing Components (Pop-up Blocker)** above). For procedure context, see [Creating Automation](docId\:wJpjTO3fjnO0JiO1DYV3S). For platform editing behavior, see [Playbooks Overview](docId\:Dp-AGNnnE2MJJFGtV2LZ5) in the Turbine User Guide. ### Recovery Steps Missing from Auto-Generated Playbook **Symptoms:** - After **Generate Remediation Plan**, you see containment and recovery-style guidance in the remediation area - **Create a Playbook** produces a playbook that has investigation or containment actions but **no recovery** steps (for example, no “rejoin host” step paired with isolation) **Root cause (expected behavior):** - Recovery is **intentionally excluded** from the auto-generated investigation playbook. The playbook is meant to run containment and related response; chaining recovery in the same automation would often **reverse** containment immediately. **What to do instead of one-off manual recovery every time:** Organizations should not rely on **ad hoc** manual recovery for every incident. Standardize **reusable** recovery automation and ownership so analysts are not overwhelmed. **Resolution:** 1. Use the generated playbook for **investigation and containment** automation as designed. 2. **Maintain reusable recovery playbooks:** In **Orchestration** → **Playbooks**, create or import playbooks that encode recovery for common scenarios (for example, rejoin host, revoke block, rotate credentials). Run them **after** containment is verified and your change or approval process allows restoration. The same playbook can serve many incidents. 3. **Seed recovery playbooks from the remediation plan:** Use **Generate Remediation Plan** to capture recovery-oriented steps, then add those steps to a **saved** recovery playbook once. Reuse that playbook from the library instead of rebuilding steps per case. 4. **Wire recovery to process, not to the same rule as isolation:** Use routing rules, case phases, or manual run-from-library as your organization requires so recovery does not fire in the same automated pass as containment. 5. Watch for in-product guidance in the planning widget; messaging may reinforce that recovery is not part of **Create a Playbook** output. For automation context, see [Creating Automation](docId\:wJpjTO3fjnO0JiO1DYV3S) and [Building Routing Rule Playbooks](docId\:vEiFYG4oYWkQ3DcMMwjXi). ### Integrated Marketplace Shows Content as Not Installed **Symptoms:** - A component (for example, an IPQualityScore enrichment VIC) is present because AI SOC or another bundle installed it, but **Integrated Marketplace** still shows **Install** or does not show **Installed** - Same behavior after **export/import** or **promotion** between tenants **Root cause:** - Content installed from **Swimlane Content** is tagged **Swimlane Content**. When content is **copied** to another tenant via import or promotion, the destination often treats it as **User Content**. The Marketplace then may not associate it with the catalog install state. **Resolution:** 1. Read **Installing and Configuring AI SOC Solution** → **Swimlane Content, User Content, and Integrated Marketplace**. 2. **Do not** click **Install** from the Marketplace blindly if promoted content already exists; you may **overwrite** customizations. 3. Compare **Marketplace version** to the content already in the tenant before installing or updating. 4. For new environments, prefer installing AI SOC from **Swimlane Content** in that tenant when you need Marketplace install state to stay aligned. ### AI Alert Analysis Panel Not Visible **Symptoms:** - AI Alert Analysis panel does not appear on Signal records - Panel is missing from the record layout - Other users can see the panel but you cannot **Root Causes:** - Panel is disabled in widget configuration - Role-based access control (RBAC) restricts visibility - Widget configuration is incorrect - Application layout doesn't include the panel **Resolution:** 1. **Check widget configuration:** - Verify the AI Alert Analysis panel is enabled in Application Builder - Confirm summarySection, planSection, and automationSection are enabled - Review widget configuration settings 2. **Verify RBAC settings:** - Check that your role has access to view the panel sections - Confirm roles: \["\*"] or your specific role is included in configuration - Review role assignments with your administrator 3. **Check application layout:** - Verify the panel is added to the **Case Management** application layout (**Case Analysis** tab, **AI Analysis** widget) - Ensure the widget is properly embedded in the record view - Confirm no layout customizations removed the panel **Prevention:** - Document widget configuration during setup - Regularly audit RBAC settings to ensure appropriate access - Test panel visibility after application layout changes ## Threat Intelligence Issues ### Threat Intelligence Shows "Error" Status **Symptoms:** - Observable enrichment shows "error" status for one or more providers - Threat Intelligence panel displays error indicators - Enrichment results are missing or incomplete - Some providers work while others fail **Root Causes:** - Provider API credentials are missing, invalid, or expired - Provider service is unavailable or rate-limited - Observable type is not supported by the provider - Network connectivity issues to provider APIs **Resolution:** 1. **Verify provider credentials:** - Go to **Assets** and locate the provider asset (for example, VirusTotal, AbuseIPDB) - Check that API keys or credentials are configured and valid - Verify credentials haven't expired - Test credentials by making a manual API call if possible 2. **Check provider service status:** - Visit the provider's status page (if available) - Verify the provider API is operational - Check for rate limit notifications or service disruptions 3. **Validate observable type:** - Confirm the observable type (IP, domain, hash, etc.) is supported by the provider - Review provider documentation for supported types - Some providers only support specific observable types 4. **Review enrichment retry logic:** - TI enrichment automatically retries up to 5 times (about once per minute) - Wait a few minutes to see if enrichment completes - Check the **Raw Enrichments** panel for detailed error messages 5. **Test provider connectivity:** - Verify network connectivity to provider APIs - Check firewall rules allow outbound connections - Confirm no proxy settings are blocking requests **Prevention:** - Regularly rotate and update API credentials before expiration - Monitor provider service status pages - Configure multiple providers for redundancy - Set up credential expiration alerts - Document provider-specific requirements and limitations ### Threat Intelligence Enrichment Never Completes **Symptoms:** - Enrichment status remains "pending" indefinitely - No results appear after several minutes - Enrichment appears stuck **Root Causes:** - Enrichment job is queued but not processing - Provider API is slow to respond - Too many concurrent enrichment requests - Playbook or sensor processing the enrichment is disabled **Resolution:** 1. **Check enrichment job status:** - Review playbook execution logs for enrichment playbooks - Verify the enrichment playbook is enabled and running - Check for any playbook execution errors 2. **Verify sensor configuration:** - Ensure sensors triggering enrichment are enabled - Check sensor schedules if using cron-based enrichment - Confirm webhook sensors are receiving events 3. **Review provider response times:** - Some providers may take several minutes to respond - Check provider documentation for expected response times - Consider provider rate limits if making many requests 4. **Check system resources:** - Verify Turbine has sufficient resources to process jobs - Review system logs for resource constraints - Check for playbook execution backlogs **Prevention:** - Monitor enrichment completion times - Set up alerts for enrichment jobs that exceed expected duration - Configure appropriate timeouts for provider API calls - Use multiple providers to avoid single points of failure ### Missing Threat Intelligence Data **Symptoms:** - Threat Intelligence panel is empty - No enrichment results are displayed - Observables exist but have no TI data **Root Causes:** - No threat intelligence providers are configured - Enrichment playbooks are not running - Observables haven't been extracted from signals - Enrichment hasn't been triggered **Resolution:** 1. **Verify providers are configured:** - Go to **Assets** and confirm at least one TI provider is configured - Check that provider credentials are valid - Ensure providers are enabled and accessible 2. **Check observable extraction:** - Verify observables are present on the Signal record - Confirm observable extraction playbooks have run - Review signal data to ensure observables were identified 3. **Trigger enrichment manually:** - If enrichment playbooks are configured, trigger them manually - Check playbook execution logs for errors - Verify sensors are properly configured to trigger enrichment 4. **Review enrichment playbook configuration:** - Ensure enrichment playbooks are enabled - Verify playbooks are configured to run on signal creation or update - Check playbook triggers and conditions **Prevention:** - Configure multiple TI providers during initial setup - Test enrichment workflow after configuration - Set up monitoring for enrichment completion rates - Document which providers support which observable types ## Signal Ingestion Issues ### Signals Not Being Created **Symptoms:** - Alerts or emails are sent but no Signal records appear - Expected signals are missing - Ingestion appears to be failing **Root Causes:** - Ingestion playbooks are disabled - Sensors are not receiving events - Webhook endpoints are misconfigured - Data transformation is failing **Resolution:** 1. **Verify ingestion playbooks are enabled:** - Go to **Playbooks** and locate ingestion playbooks (for example, "Ingest Webhook Alert", "Ingest Bulk Alerts") - Confirm playbooks are enabled - Check playbook execution history for errors 2. **Check sensor configuration:** - Verify sensors are enabled and running - For webhook sensors, confirm the endpoint URL is correct - For cron sensors, verify the schedule is configured - For email sensors, ensure email ingestion is set up 3. **Test webhook endpoints:** - Send a test alert to the webhook endpoint - Verify the webhook receives the request - Check webhook logs for incoming requests 4. **Review data transformation:** - Verify TEDS mapping is correct - Check that alert data matches expected schema - Review transformation playbook logs for errors 5. **Check playbook triggers:** - Confirm playbooks are triggered by the correct sensor events - Verify trigger conditions are met - Review sensor event logs **Prevention:** - Test ingestion workflows after configuration - Set up monitoring for signal creation rates - Document expected signal volumes - Regularly review ingestion playbook execution logs ### Signals Missing Required Fields **Symptoms:** - Signal records are created but fields are empty - Required fields like observables are missing - Signal data is incomplete **Root Causes:** - Data transformation is not mapping fields correctly - Source alert data doesn't contain expected fields - Field extraction playbooks haven't run - TEDS mapping is incorrect **Resolution:** 1. **Review source data:** - Check the raw alert data sent to the ingestion endpoint - Verify source systems are sending complete data - Compare expected vs. actual field values 2. **Validate TEDS mapping:** - Review the TEDS transformation in ingestion playbooks - Verify field mappings are correct - Test transformation with sample data 3. **Check field extraction:** - Ensure observable extraction playbooks have run - Verify extraction logic is working correctly - Review extraction playbook logs 4. **Test with sample data:** - Send a test alert with known field values - Verify fields are populated correctly - Compare input data to Signal record fields **Prevention:** - Document expected field mappings during setup - Test transformations with representative sample data - Validate field extraction regularly - Set up alerts for signals with missing critical fields ## Playbook Execution Issues The following sections cover playbook issues you are most likely to see when using AI SOC: investigation plan steps that fail when you click **Run**, and ingestion, enrichment, or investigation playbook failures. ### Investigation Plan Steps Fail When You Click Run **Symptoms:** - Clicking **Run** or **Run All Steps** on an investigation plan step fails - Step shows failure or error in the plan timeline - "Install" or missing component message appears for a step **Root Causes (AI SOC–specific):** - Component required by the plan step is not installed (for example, TI provider, EDR connector) - Asset (credentials) for the component is missing or invalid - Signal is missing required fields the step needs (for example, observable, host ID) **Resolution:** 1. **Identify the failing step** in the plan timeline and note the component or action name. 2. **Install missing components** if the step shows **Install** — use the Swimlane content library or Marketplace. 3. **Configure assets** for that component (API keys, credentials) under Orchestration → Assets. 4. **Confirm signal data** — ensure observables or other required fields are present on the signal. **Prevention:** - Install and configure components and assets before running plan steps. - Use **Review** on each step to see required inputs before running. **Other playbook failures (ingestion, enrichment, routing):** For failures outside the investigation plan (for example, ingestion playbook runs but no signal is created, enrichment fails, or a routing rule triggers a playbook that fails), use playbook execution logs and your platform's playbook troubleshooting documentation. Common causes include missing or misconfigured components, invalid or expired assets, external service unavailability, and incorrect playbook or sensor configuration. ### No Steps Available in Investigation Plan **Symptoms:** - Plan is generated but shows no steps - Plan section is empty - "No steps available" message appears **Root Causes:** - Signal has no observables - Threat intelligence enrichment hasn't completed - No relevant components are available - Signal data is insufficient **Resolution:** 1. **Verify observables exist:** - Check the Signal record for observables (IPs, domains, hashes, etc.) - Ensure observable extraction has completed - Review signal data to confirm observables were identified 2. **Wait for enrichment:** - Threat intelligence enrichment may be required before steps are generated - Check enrichment status in Threat Intelligence panel - Wait for enrichment to complete, then regenerate the plan 3. **Check component availability:** - Verify relevant components are installed - Confirm components are available in the marketplace - Review component compatibility 4. **Review signal completeness:** - Ensure signal has sufficient data for plan generation - Verify signal source and type are set correctly - Check that signal has relevant context **Prevention:** - Ensure observable extraction runs before plan generation - Configure multiple enrichment providers for better coverage - Maintain a library of commonly used components - Document expected signal data requirements ### No Playbooks Appear for Routing **Symptoms:** - When creating a routing rule, no playbooks appear in the selection - Playbook dropdown is empty - "No playbooks available" message **Root Causes:** - No playbooks in the tenant use a **Flow Event** trigger with the **Rule-Execute** existing flow event (the list only includes compatible playbooks) - The routing rule page has not finished loading (the playbook list populates after load) - Playbooks are disabled or not in an accessible workspace - Permission issues prevent listing playbooks **Resolution:** 1. **Wait for the rule record to load** fully, then open the playbook dropdown again. 2. **Confirm the playbook uses Rule-Execute:** Open the playbook in **Orchestration** and verify a **Flow Event** trigger with **Existing flow event** set to **rule execute** (**Rule-Execute**). Playbooks without this trigger do not appear in the routing rule list. 3. **Build a compatible playbook:** Follow [Building Routing Rule Playbooks](docId\:vEiFYG4oYWkQ3DcMMwjXi). 4. **Check playbook status and permissions:** Ensure the playbook is saved, enabled, and your role can access orchestration content. **Prevention:** - Create **investigation playbooks** with **Rule-Execute** before associating them on a rule - Test routing rules after playbook changes ### New Triage Rules Get Rule Order Above the Catch-All **Symptoms:** - Catch-all agentic rule uses **Rule Order** **99999** (or similar), but **Create a Triage Rule** assigns a higher order (for example **100000**) - Specific rules evaluate **after** the intended catch-all instead of before it **Root Causes:** - The high-order rule is **not** associated with **AI SOC - Trigger Analysis Agent via Routing Rule** - Auto **Rule Order** for **Create a Triage Rule** excludes only rules associated with that playbook when calculating the next order **Resolution:** 1. Open the catch-all **Signal Routing Rules** record. 2. Set **Associated Playbook** (or **Selected Playbook**) to **AI SOC - Trigger Analysis Agent via Routing Rule**, then **Apply rule to playbook**. 3. Confirm **Rule Order** remains high (for example **99999**). 4. Create or update specific triage rules so their orders sit **before** the catch-all. See [Creating Automation](docId\:wJpjTO3fjnO0JiO1DYV3S) and [Building Routing Rule Playbooks](docId\:vEiFYG4oYWkQ3DcMMwjXi). **Prevention:** - Treat the Trigger Analysis Agent playbook association as **required** for the unmatched / first-seen catch-all—not optional - Optionally name the catch-all **AI Agentic Investigation** so operators can find it quickly ### Investigation Playbook Does Not Run **Symptoms:** - Routing rule shows matches in **Records Matched** but the expected automation does not run - Playbook is selected on the rule but investigation or verdict steps never execute - Wrong playbook runs or playbook run fails immediately **Root Causes:** - Playbook is not compatible for routing (missing **Rule-Execute** trigger, **Search Records** on **tracking ID**, verdict component, or `$actions`; or rule was not applied to the playbook) - Playbook has more than one flow - **Associated Playbook** name does not match the enabled playbook in **Orchestration** - Playbook is disabled or missing component or asset permissions **Resolution:** 1. Open the playbook in **Orchestration** and verify the requirements in [Building Routing Rule Playbooks](docId\:vEiFYG4oYWkQ3DcMMwjXi). 2. Confirm the trigger listens for **Rule-Execute**. Re-apply the rule to the playbook on the routing rule record if the **rule UUID** condition is missing, then refresh the playbook in **Orchestration**. 3. Confirm the flow includes a verdict component and earlier steps pass outputs via `$actions` where required. 4. On the routing rule record, re-select **Associated Playbook** or **Selected Playbook** using the exact playbook name. 5. Use **Run Rule Against Pending Signals** on the rule **Support** tab and review playbook run logs. **Prevention:** - Duplicate working investigation playbooks instead of building from scratch without the template - Test with **Run Rule Against Pending Signals** before enabling rules in production ## Configuration Issues ### RBAC: Features Not Visible or Accessible **Symptoms:** - Certain features or sections are not visible - Actions are disabled or missing - Different users see different options - Permission errors when performing actions **Root Causes:** - Role-based access control (RBAC) restricts feature visibility - Widget configuration limits access by role - User role assignments are incorrect - Configuration changes haven't been applied **Resolution:** 1. **Review widget configuration:** - Check AI Alert Analysis panel configuration - Verify roles settings for each section (summary, plan, automation) - Confirm your role is included in allowed roles 2. **Verify role assignments:** - Check your user role assignments - Confirm you have the necessary permissions - Review role definitions with your administrator 3. **Check section-specific settings:** - summarySection, planSection, automationSection each have role settings - generatePlan, modifyPlan, executePlan have separate role controls - Verify each action you need is enabled for your role 4. **Review application permissions:** - Check workspace and application access - Verify record-level permissions - Confirm field-level permissions if applicable 5. **Review platform RBAC mode (legacy versus enhanced):** - In **enhanced RBAC**, confirm the user has **Read** and **Execute** on **components** used in plans and automation (for example **AI SOC - CASE Hero AI Analysis**). - In **legacy RBAC**, **Orchestrator**-level permissions are required for full AI SOC usage when features depend on components and orchestration. - See [RBAC Considerations for AI SOC](docId\:Jl6Dsw0QjBkPq_iOJDgLp). **Prevention:** - Document RBAC configuration during setup - Regularly audit role assignments - Test feature visibility for each role - Update documentation when RBAC changes ### Application Layout Issues **Symptoms:** - Panels or widgets are missing from records - Layout appears different than expected - Customizations are not visible **Root Causes:** - Widget is not added to application layout - Layout customizations were removed - Widget configuration is incorrect - Application layout was reset **Resolution:** 1. **Check application layout:** - Go to Application Builder for the application - Verify widgets are added to the layout - Confirm widget placement and visibility 2. **Review widget configuration:** - Check widget settings in Application Builder - Verify widget is enabled - Confirm widget configuration matches requirements 3. **Restore layout if needed:** - Check if layout was recently modified - Restore from backup if available - Re-add widgets if they were removed **Prevention:** - Document application layouts - Backup layout configurations before changes - Test layout changes in a development environment first - Limit who can modify application layouts ## General Troubleshooting Tips ### Before Contacting Support 1. **Gather information:** - Note the exact error message or symptom - Record when the issue started - Identify if it affects all users or specific users - Check if it's consistent or intermittent 2. **Review logs:** - Check browser console for errors (F12 → Console) - Review playbook execution logs - Check system logs if accessible 3. **Test basic functionality:** - Verify other AI SOC features are working - Test with a different signal or record - Try a different browser or user account 4. **Check recent changes:** - Review recent configuration changes - Check for system updates or maintenance - Verify no recent playbook or workflow changes ### Common Diagnostic Steps 1. **Clear browser cache:** - Hard refresh (Ctrl+Shift+R or Cmd+Shift+R) - Clear browser cache and cookies - Try incognito/private browsing mode 2. **Verify connectivity:** - Check network connectivity - Verify access to external services - Test API endpoints if applicable 3. **Check system status:** - Review system status pages - Verify no scheduled maintenance - Check for known issues or outages 4. **Review documentation:** - Check this troubleshooting guide - Review relevant user guide sections - Consult configuration documentation ### Getting Additional Help If you've tried the troubleshooting steps above and the issue persists: 1. **Contact your system administrator** for: - Hero AI service configuration - RBAC and permission issues - System-level configuration problems 2. **Escalate to Swimlane Support** with: - Detailed error messages - Steps to reproduce the issue - Relevant log entries - System and browser information