---
title: Understanding Verdict Generation
slug: solutions/understanding-verdict-generation
docTags: 
createdAt: 2026-03-04T10:50:26.458Z
---

The **Generate Verdict** step in the Determination phase uses Hero AI to analyze the signal and produce a verdict.

### Verdict Inputs

The verdict generation uses:

- Signal tracking ID
- Signal data (observables, severity, source, etc.)
- Threat intelligence enrichment results
- Knowledge Base Articles linked to the signal
- Similar signals and their verdicts
- Investigation comments and summaries

### Collect Outputs Before the Verdict

The verdict must receive the outputs from all completed investigation actions. In AI SOC 26.2.0 playbooks, **AI SOC - Collect Playbook Outputs** runs immediately before the verdict component and collects successful action outputs from the current playbook run.

:::hint{type="warning"}
**Upgrading a playbook created with AI SOC content earlier than 26.2.0:** Add **AI SOC - Collect Playbook Outputs** immediately before the verdict component and set **Playbook Run Id** to `$run.id`. Without this step, a playbook that calls multiple components inside a loop may pass only the last component output to Hero AI, which can produce an incomplete or incorrect verdict. New playbooks created from AI SOC 26.2.0 content already include this component.
:::

For the full playbook structure, see [Building Routing Rule Playbooks](<./Building Routing Rule Playbooks.md>).

### Verdict Outputs

After running the verdict step, you'll see:

**Final AI Verdict:**

- **Malicious:** Confirmed threat requiring response
- **Suspicious:** Needs further investigation
- **Benign:** False positive, no threat
- **Unknown:** Insufficient data to determine

**Verdict Analysis:**

- Narrative explanation of the verdict
- Confidence score (0-10 scale)
- Summary of key factors
- Improvement guidance (what data would increase confidence)

**Threat Intelligence Analysis:**

- TI verdict and confidence
- Summary of TI findings
- Improvement guidance

**MITRE ATT\&CK Context:**

- Mapped techniques and tactics
- D3FEND guidance
- Considerations and recommendations

**Overall Confidence Score:**

- Combined confidence from all analysis factors

### Using Verdict Results

**Review the verdict:**

- Check the confidence score - higher confidence (8-10) indicates strong agreement across factors
- Read the analysis narrative to understand the reasoning
- Review improvement guidance if confidence is low

**Compare with manual assessment:**

- If you disagree with the AI verdict, set a **Manual Verdict**
- Add investigation comments explaining your reasoning
- This helps improve future AI analysis

**Take action:**

- **Malicious verdicts:** Generate a remediation plan and use **Case Management** workflow (for example **Escalated** status or coordinated handoff) when your process requires it
- **Suspicious verdicts:** Continue investigation, or raise priority or status when risk is high
- **Benign verdicts:** Resolve the signal and document as false positive
- **Unknown verdicts:** Gather more evidence and re-run analysis

##