---
title: Use AI SOC for MSSP Central
slug: solutions/use-ai-soc-for-mssp-central
docTags: 
createdAt: 2026-04-28T00:00:00.000Z
---

Use this guide for **day-to-day analyst and operations workflows in the central tenant** after MSSP sync is configured. This page does not cover installing solution layers, configuring webhooks or assets, or onboarding a new client tenant.

## Choose Your Path

| If You Need To...                                                 | Go To                                                               |
| ----------------------------------------------------------------- | ------------------------------------------------------------------- |
| Configure webhooks, assets, or sync for client or central tenants | [Configure AI SOC for MSSP](docId\:AzfPz-c_qLu3ElVSZkLLw)           |
| Add another customer client tenant                                | [Onboard a Client Tenant](docId\:fGkw7if8VsR9_hchdeXUS)             |
| Fix missing or stale sync                                         | [Validate and Troubleshoot MSSP Sync](docId\:QYEsknwk-RnSc1w1uax_D) |
| First MSSP deployment                                             | [Getting Started for MSSP](docId\:ivvy6GXAjWc34xVMnNqC-)            |
| MSSP overview                                                     | [AI SOC for MSSP](docId\:EuF_WH3LJLAmPhBNkMvOs)                     |

## Daily Workflow

1. Open the **AI SOC MSSP Central** workspace.
2. Review incoming and recently updated records in **Central Case Management**.
3. Filter by **Client\_Name** to inspect tenant-specific workloads.
4. Identify records requiring follow-up with client SOC teams.
5. Review TI cache updates for frequently recurring observables.
6. Open **Central SOC Reporting Workspace** for cross-client aggregates.
7. Use **Usage Statistics** to track workload and adoption across clients.

## Central Reporting and Dashboards

Use central applications and workspaces to monitor clients. Client tenants also have **AI SOC MSSP Reporting** for local aggregates that sync to central.

| Where                  | What to use                                                                                                                                                                                  |
| ---------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| **Central tenant**     | **Central Case Management**, **Threat Intelligence Artifact Cache**, **Central SOC Reporting**, **Usage Statistics**, **AI SOC MSSP Central** workspace, **Central SOC Reporting Workspace** |
| **Each client tenant** | **AI SOC MSSP Reporting** / **AI SOC MSSP Reporting Workspace**, and the analyst **AI SOC** workspace from Core                                                                              |

| Reporting Goal                           | Recommended View                                            |
| ---------------------------------------- | ----------------------------------------------------------- |
| Compare workload by client               | Central case list filtered by **Client\_Name**              |
| Track weekly and historical aggregates   | **Central SOC Reporting Workspace**                         |
| Spot recurring indicators across clients | **Threat Intelligence Artifact Cache** searches and filters |
| Check tenant participation               | **Usage Statistics** by client                              |

For client-tenant AI SOC dashboards, analysts work in that client tenant. See [Dashboards](docId\:AAYntc5RuMVE6M_Xru_0_) in the AI SOC Solution guide.

## Work With Central SOC Reporting

A cron playbook in the client tenant writes aggregate records to **AI SOC MSSP Reporting**. **SOC Reporting Sync** posts those records to the central **Ingest Record from Client** webhook. **Upsert Central Report Record** stores them in **Central SOC Reporting**. Dashboards in **Central SOC Reporting Workspace** read that aggregate data.

### Report fields

| Field               | What it stores                                                              |
| ------------------- | --------------------------------------------------------------------------- |
| **Report Type**     | `Cases`, `MTTD`, or `MTTR`                                                  |
| **Report Span**     | `New` or `Total`                                                            |
| **Timestamp**       | `00:00:00` on the day the report job runs (UTC)                             |
| **Report Criteria** | Dimension for the aggregate (see the combinations below)                    |
| **Criteria Value**  | Value for that dimension (for example, Critical)                            |
| **Count / Value**   | The aggregate number                                                        |
| **Client Name**     | **Client\_Name** from the client **AI SOC MSSP Client Configuration** asset |

The **AI SOC MSSP SOC Reporting** playbook writes these **Report Type** and **Report Criteria** combinations:

| Report Type | Report Criteria                                                                                                                     |
| ----------- | ----------------------------------------------------------------------------------------------------------------------------------- |
| **Cases**   | Total, Severity, AI Verdict, Threat Intelligence Verdict, MITRE Techniques, Manual Verdict, Signal Source, Owner, Closed by Hero AI |
| **MTTD**    | Signal Source                                                                                                                       |
| **MTTR**    | Signal Source                                                                                                                       |

**Owner** is written for the **Total** span only. All other **Cases** criteria are written for both **New** and **Total**.

**New** is the aggregate for the past week. **Total** is near-full history (lookback of 9999 weeks). Dashboard filters default to **current week**, except trend-line reports.

:::hint{type="warning"}
**Central SOC Reporting — current week filter on Sundays**

Central SOC Reporting dashboards default to a Current week filter (except trend lines). That filter uses your local timezone. Reporting timestamps are stored in UTC at midnight on the day the weekly job runs.

On Sundays, the Current week filter can return no results even when data exists. On **Central SOC Reporting Workspace** dashboards, change the **Current week** date filter to a custom range that includes the report timestamps, or check again after Sunday in your timezone. **New** is the last week of aggregates; **Total** is near-full history.
:::

## Work With Central Case Management

Use **Central Case Management** as the aggregate visibility layer.

| Task                       | Action                                                |
| -------------------------- | ----------------------------------------------------- |
| Review new client activity | Sort by create time and filter by **Client\_Name**    |
| Track case progression     | Monitor status and last update fields over time       |
| Validate propagation       | Compare key values between client and central records |
| Confirm client ownership   | Verify **Client\_Name** on each central record        |

### Key Central Record Fields to Monitor

| Field Type                     | Why It Matters                                                  |
| ------------------------------ | --------------------------------------------------------------- |
| **Client\_Name**               | Confirm source tenant and avoid cross-client confusion          |
| Client tracking identifier     | Correlate central records back to client records quickly        |
| Record status and last updated | Detect stale sync or delayed updates                            |
| Source record URL              | Jump directly to the originating client record for verification |

## Work With Threat Intelligence Artifact Cache

Central TIAC records are full artifact records synced from the client tenant over the API, not webhook metadata. Comparing enrichment across clients assumes threat intelligence vendors are the same across client tenants.

1. Open **Threat Intelligence Artifact Cache**.
2. Search for observables linked to active central records.
3. Confirm latest verdict and enrichment data are present.
4. Track repeated indicators across multiple clients.
5. Use cache history to detect stale or missing propagation.

### Tracking-ID gaps when observable is unique

The **observable** field in **Threat Intelligence Artifact Cache** must remain unique. Do not remove that uniqueness constraint.

When observable is unique, Tracking-ID numbers may not be assigned sequentially. Some ID numbers may be skipped if the system encounters duplicate observable values during record creation. This does not indicate data loss; skipped IDs correspond to suppressed duplicate entries.

### Request Client-Side Re-Enrichment

Use this workflow when central TI cache data is stale, incomplete, or must be refreshed after a provider or policy change.

1. Open the TI cache record in **Threat Intelligence Artifact Cache**.
2. Use **Requires Re-Enrichment** when it appears on the record layout or task list.
3. Save the record and confirm the re-enrichment request is stored on the TI cache record.
4. In the client tenant, confirm the observable receives a fresh enrichment pass on the next automation cycle your deployment uses for MSSP TI sync.

## Use Usage Statistics

Use **Usage Statistics** to monitor operational health across clients.

| Metric Type | What to Watch                                  |
| ----------- | ---------------------------------------------- |
| Volume      | Record growth by client and by period          |
| Activity    | Client update frequency and sync cadence       |
| Coverage    | Which clients are actively sending records     |
| Trend       | Sustained increase or drop in central activity |

## Operational Best Practices

- Standardize **Client\_Name** values to avoid duplicate or fragmented reporting views.
- Validate webhook and token configuration after every credential rotation (see [Configure AI SOC for MSSP](docId\:AzfPz-c_qLu3ElVSZkLLw)).
- Review a sample of records from each active client every day.
- Escalate repeated sync lag quickly to prevent stale central visibility.
- On Sundays, if **Central SOC Reporting** looks empty, change the **Current week** date filter on **Central SOC Reporting Workspace** dashboards to a custom range before treating it as a sync failure.