Understanding Verdict Generation
The Generate Verdict step in the Determination phase uses Hero AI to analyze the signal and produce a verdict.
Verdict Inputs
The verdict generation uses:
- Signal tracking ID
- Signal data (observables, severity, source, etc.)
- Threat intelligence enrichment results
- Knowledge Base Articles linked to the signal
- Similar signals and their verdicts
- Investigation comments and summaries
Collect Outputs Before the Verdict
The verdict must receive the outputs from all completed investigation actions. In AI SOC 26.2.0 playbooks, AI SOC - Collect Playbook Outputs runs immediately before the verdict component and collects successful action outputs from the current playbook run.
Upgrading a playbook created with AI SOC content earlier than 26.2.0: Add AI SOC - Collect Playbook Outputs immediately before the verdict component and set Playbook Run Id to $run.id. Without this step, a playbook that calls multiple components inside a loop may pass only the last component output to Hero AI, which can produce an incomplete or incorrect verdict. New playbooks created from AI SOC 26.2.0 content already include this component.
For the full playbook structure, see Building Routing Rule Playbooks.
Verdict Outputs
After running the verdict step, you'll see:
Final AI Verdict:
- Malicious: Confirmed threat requiring response
- Suspicious: Needs further investigation
- Benign: False positive, no threat
- Unknown: Insufficient data to determine
Verdict Analysis:
- Narrative explanation of the verdict
- Confidence score (0-10 scale)
- Summary of key factors
- Improvement guidance (what data would increase confidence)
Threat Intelligence Analysis:
- TI verdict and confidence
- Summary of TI findings
- Improvement guidance
MITRE ATT&CK Context:
- Mapped techniques and tactics
- D3FEND guidance
- Considerations and recommendations
Overall Confidence Score:
- Combined confidence from all analysis factors
Using Verdict Results
Review the verdict:
- Check the confidence score - higher confidence (8-10) indicates strong agreement across factors
- Read the analysis narrative to understand the reasoning
- Review improvement guidance if confidence is low
Compare with manual assessment:
- If you disagree with the AI verdict, set a Manual Verdict
- Add investigation comments explaining your reasoning
- This helps improve future AI analysis
Take action:
- Malicious verdicts: Generate a remediation plan and use Case Management workflow (for example Escalated status or coordinated handoff) when your process requires it
- Suspicious verdicts: Continue investigation, or raise priority or status when risk is high
- Benign verdicts: Resolve the signal and document as false positive
- Unknown verdicts: Gather more evidence and re-run analysis