--- title: AI SOC Solution Release 26.2.0 slug: turbine-release-notes/XOYD-ai-soc-2 docTags: createdAt: 2026-07-29T11:55:04.703Z --- AI SOC 26.2.0 adds agentic investigation and improves analyst workflows with clearer progress feedback and regeneration options. ## What's New in This Release? This release expands AI SOC investigation capabilities and adds new enrichment, case-management, and playbook-building improvements. ### AI SOC Solution AI SOC 26.2.0 introduces agentic investigation and improves analyst workflows with clearer progress feedback and regeneration options. Agentic investigation extends AI SOC beyond analyst-driven Generate Plan workflows. The preferred way to run the Analysis agent is through Signal Routing Rules: after solution import, create a routing rule and associate the packaged playbook **AI SOC - Trigger Analysis Agent via Routing Rule**, which calls the **AI SOC - Trigger Analysis Agent** component when a rule matches. This supports use cases such as first-seen alert types, overnight ingestion, and high-volume queues where manual plan generation is not practical. For playbook requirements and configuration, see [Building Routing Rule Playbooks](docId\:vEiFYG4oYWkQ3DcMMwjXi). Optionally, on a single Case Management record, set **Analysis Mode** to **Autonomous** under **Agentic Investigation Data** on the **Support** tab (or on the **Case Analysis** metadata column), then click **Re-investigate** in **AI Alert Analysis** to start the Analysis agent on that record. The agent generates and runs investigation plan steps without requiring an analyst to initiate each phase manually. For the analyst workflow and record controls, see [Case Management (CASE)](docId\:sDpESfT6Lsyz0zfrn_hok). Additional 26.2.0 AI SOC improvements include: - **Progress detail** — real-time status messages during Generate Plan, remediation plan generation, regeneration, and agentic runs, so analysts see what the agent is working on instead of a generic wait state. See [Case Management (CASE)](docId\:sDpESfT6Lsyz0zfrn_hok). - **Regenerate** — Regenerate Investigation Plan, Regenerate Remediation Plan, and **Recreate Playbook** when results need refinement without restarting the full investigation. See [Investigation Plan Workflow](docId\:BdE8P71Mmp2LByMuZuOOI) and [Creating Automation](docId\:wJpjTO3fjnO0JiO1DYV3S). - **Manual path unchanged** — analysts can still use Manual analysis mode and step through plans interactively when review is required. See [Getting Started](docId\:p7QJQUayeKczHPxEpPWcp). - **N+1 playbook run details** — when a routing playbook runs for a subsequent alert and the case does not yet have an investigation plan, the **Playbook Run Details** panel under **Automation** in **AI Alert Analysis** lists each collected step on the **Case Management** record so analysts can review execution without permission to open playbook runs. The **AI SOC - Collect Playbook Execution Data** component supplies these execution details. See [Creating Automation](docId\:wJpjTO3fjnO0JiO1DYV3S). - **URLScan threat intelligence** — added URL and domain enrichment through the URLScan connector, asset, and **Enrich - URLScan Enrich Observable (VIC)** component. See [Configure Threat Intelligence Enrichment](docId:_wafAIm1sG-7z1UZmvr-P). - **Actionable invalid-observable notifications** — notifications now identify the Case Management record that received an invalid observable and link back to that case. See [Case Management (CASE)](docId\:sDpESfT6Lsyz0zfrn_hok). - **MITRE ATT\&CK links** — tactic and technique names and IDs in **MITRE ATT\&CK References** now link to their corresponding MITRE pages. See [Case Management (CASE)](docId\:sDpESfT6Lsyz0zfrn_hok). - **Linked cases** — relate Case Management records with **Parent Case** and **Child Cases**, then use **Sync from Parent Case** or **Sync to Child Cases** to synchronize classification, manual verdict, status, and owner. See [Case Management (CASE)](docId\:sDpESfT6Lsyz0zfrn_hok). ### Action Required When Upgrading Existing Investigation Playbooks If you created an investigation playbook with AI SOC content earlier than **26.2.0** and retain that playbook after upgrading the content, add **AI SOC - Collect Playbook Outputs** immediately before the verdict component. Set **Playbook Run Id** to `$run.id`. This component collects outputs from successful actions in the current playbook run. Without it, a playbook that calls multiple components inside a loop may pass only the last component output to Hero AI, resulting in an incomplete or incorrect verdict. New playbooks created from AI SOC 26.2.0 content already include this component. For configuration and troubleshooting, see [Building Routing Rule Playbooks](docId\:vEiFYG4oYWkQ3DcMMwjXi), [Understanding Verdict Generation](docId\:bnyC263YSL2bmAJhBaIOb), and [Troubleshooting](docId\:cKnuXQV85k9lu0OCqV218) in the AI SOC Solution user guide. ## Addressed Issues - **AI SOC Generate Plan Returned Inconsistent Plans for the Same Input** — Fixed an issue where AI SOC Generate Plan produced different investigation plans for the same alert details and payload on repeated runs. Generate Plan now returns more consistent plans for equivalent inputs. # Known Issues ## AI SOC - **Collect Playbook Execution Data Fails When the Playbook Includes Connector Actions **— When an AI SOC investigation playbook includes a connector action added directly on the canvas (for example, an action created by the planning widget), the **AI SOC - Collect Playbook Execution Data** component can fail. As a result, N+1 playbook run details may not appear on the **Case Management** record in **AI Alert Analysis**. A fix is planned for a later AI SOC release.