AI SOC Solution Release 26.3.0
Key Outcomes
The AI SOC 26.3.0 release introduces a modular, widget-based interface for case management, a new knowledge base article system, and a clearer interactive timeline. The update improves how case data is organized, how analysts move through a case, and how the layout can be changed, and it brings AI and manual verdicts into one place.
New Knowledge Base Article System
- Knowledge base articles β More than 100 knowledge base articles ship with the solution. They provide best practices and general guidance for common alert types, based on the National Institute of Standards and Technology (NIST) framework.
- Article management β The Manage KB articles dashboard widget lists knowledge base articles. You can open an article to edit it, delete an article, and enable or disable selected articles. Convert All fills Conditions on older articles that do not have them.
- Conditional logic β You can add advanced conditional logic through a widget that matches the platform condition builder, so alert matching against knowledge base articles is more precise.
User Interface and User Experience Overhaul and Modular Design
- Modular widget architecture β Replaces the previous layout. The top header, sidebar, and main cards are all individual widgets.
- Customization β Customers can reorder widgets, move them to separate tabs, or change the layout to fit their workflow.
- Card states β Cards can be fully expanded, partially expanded (the default), or fully collapsed.
- Case header β The header provides a high-level snapshot: alert name, one-sentence description, First Evidence time, case owner, manual classification, severity, AI verdict, AI verdict confidence score, priority, and status.
- Technology logos β A logo appears in the header when a matching signal source is available. Otherwise, the header uses the default Swimlane logo.
Enhanced Case Timeline
- Interactive timeline β Replaces the previous grayscale widget and is now more prominent.
- Event clustering β Groups events that occur close together so the timeline is easier to scan.
- Visual legend β Uses these markers:
- Check marks β Case Milestone, for example case created and first evidence.
- Green β Turbine Automation.
- Blue β Hero AI.
- Orange β User. Actions a person takes, for example a manual verdict change.
- Gray β Other. Events with no recorded source.
- Hover details β Show what happened, including the timestamp and the playbook or component responsible for the change.
- Timeline output β Entries can appear as plain text or as JavaScript Object Notation.
Verdict and Threat Intel Improvements
- Single case verdict β One verdict appears in the top header, so AI and manual verdicts are not shown as competing values.
- AI verdict β The AI verdict is the default display. It includes the AI logo and the confidence score.
- Manual override β A drop-down list sets a manual verdict, updates the icon, and hides the confidence score.
- Threat Intel widget β Shows the intelligence verdict together with status, risk score, and the related threat intelligence records.
- AI analysis β When fully expanded, the Threat Intelligence widget shows AI Analysis and Improvements, and the Case Summary widget shows AI Verdict Analysis and Improvements. The two widgets read different fields.
Widget Consolidation and Separation
- Case Summary and Case Snapshot β The Case Summary card on the Case Investigation tab and the Case Snapshot tab use separate widgets.
- Investigation and remediation β These are two widgets, so investigation steps stay separate from remediation actions.
- Automation β Playbook and triage-rule creation is in its own widget.
- MITRE ATT&CK and D3FEND β One widget combines MITRE ATT&CK and D3FEND. Automation maps attack techniques to the relevant D3FEND techniques.
- Manual remediation β Playbook button triggers are on the front of the case. They were previously on the Support tab.
- Analyst investigation β Analyst investigation and notes have their own card.
Investigation Types
- Available types β Three investigation types are available:
- AI Assisted β Analyst and AI collaboration. The analyst stays in the loop.
- Agentic β Analyst Agent. An AI agent runs the investigation.
- Automated β Investigation Playbook. Playbooks and routing rules run the investigation. Automated appears in the menu only after the case timeline records Case Investigation Type Update - Automated.
- Where it appears β The investigation type is visible in both the investigation widget and the sidebar widget.
For more information, see Case Management (CASE)Case Management (CASE).
Additional Changes
AI Alert Ingestion Content
The release includes the updated AI Alert Ingestion content. On Alert Schema Store, edit AI Mapping Translation (Alert β TEDs) beside Example Raw Alert. TEDs is the on-screen name for Turbine Schema. The ai_mapping, schema_sample, and schema_fingerprint fields stay read-only. For more information, see Review or Edit an Alert Mapping.
Action Required: Enable Date/Time Field Trigger
Customers who use SLA breach notifications or case correlation need Date/Time Field Trigger enabled.
If you do nothing, SLA Exceeded Notification stays idle when SLA Target is reached, and Case Correlation (Time Delay) stays idle when the Case Correlation Date/Time is reached. The record shows no error.
Enable Date/Time Field Trigger before you rely on those playbooks. For more information, see Case Management (CASE)Case Management (CASE).
Action Required: Set SLA Hours After Upgrade
Customers who set SLA hours by source (Alert, Phishing Triage, or Manual) need to set the new inputs before they rely on a custom window.
Those source inputs are not in this package. If you do nothing, new cases use these package defaults:
- Baseline: 6 hours
- P0: 2 hours
- P1: 4 hours
- P2: 5 hours
- P3: 6 hours
- P4: 7 hours
Open Orchestration β Assets β AI SOC General Configuration, and set Baseline and SLA by Priority. For more information, see Configure Custom AssetsConfigure Custom Assets.
Action Required: Add Collect Playbook Outputs to Older Investigation Playbooks
Customers who keep an investigation playbook created before AI SOC 26.2.0 need to add AI SOC - Collect Playbook Outputs immediately before the verdict component. Set Playbook Run ID to $run.id.
If you do nothing, a playbook that calls multiple components inside a loop may send only the last component output to Hero AI. Playbooks created from current AI SOC content already include this component.
SLA by Priority and Breach Notification
SLA Target stores the date and time when the SLA window ends. SLA Exceeded Notification runs at that time and sends an in-app notification to the current owner. After that notification succeeds, the playbook writes SLA Breached on Case Timeline and sets Requires Attention. SLA Target is cleared when Status is Closed.
Case Correlation (Time Delay) runs when the Case Correlation Date/Time is reached. Both playbooks run only when Date/Time Field Trigger is enabled.
Known Issues
- Unfinished Comment Warning Appears When You Leave a Case Without Changes β On some cases, when you open the case and then go back without editing anything, a dialog warns about an unfinished comment and asks you to leave or cancel. This does not happen on every case. It most often occurs after you click certain fields in the case. If you made no changes, select Leave to close the case.