--- title: AI SOC Solution Release 26.3.0 slug: turbine-release-notes/ai-soc-release-26-3-0 createdAt: 2026-10-31T07:17:32.625Z --- ## Key Outcomes The AI SOC 26.3.0 release introduces a modular, widget-based interface for case management, a new knowledge base article system, and a clearer interactive timeline. The update improves how case data is organized, how analysts move through a case, and how the layout can be changed, and it brings AI and manual verdicts into one place. ## New Knowledge Base Article System - **Knowledge base articles** — More than 100 knowledge base articles ship with the solution. They provide best practices and general guidance for common alert types, based on the National Institute of Standards and Technology (NIST) framework. - **Article management** — The **Manage KB articles** dashboard widget lists knowledge base articles. You can open an article to edit it, delete an article, and enable or disable selected articles. **Convert All** fills **Conditions** on older articles that do not have them. - **Conditional logic** — You can add advanced conditional logic through a widget that matches the platform condition builder, so alert matching against knowledge base articles is more precise. ## User Interface and User Experience Overhaul and Modular Design - **Modular widget architecture** — Replaces the previous layout. The top header, sidebar, and main cards are all individual widgets. - **Customization** — Customers can reorder widgets, move them to separate tabs, or change the layout to fit their workflow. - **Card states** — Cards can be fully expanded, partially expanded (the default), or fully collapsed. - **Case header** — The header provides a high-level snapshot: alert name, one-sentence description, **First Evidence** time, case owner, manual classification, severity, AI verdict, AI verdict confidence score, priority, and status. - **Technology logos** — A logo appears in the header when a matching signal source is available. Otherwise, the header uses the default Swimlane logo. ## Enhanced Case Timeline - **Interactive timeline** — Replaces the previous grayscale widget and is now more prominent. - **Event clustering** — Groups events that occur close together so the timeline is easier to scan. - **Visual legend** — Uses these markers: - **Check marks** — **Case Milestone**, for example case created and first evidence. - **Green** — **Turbine Automation**. - **Blue** — **Hero AI**. - **Orange** — **User**. Actions a person takes, for example a manual verdict change. - **Gray** — **Other**. Events with no recorded source. - **Hover details** — Show what happened, including the timestamp and the playbook or component responsible for the change. - **Timeline output** — Entries can appear as plain text or as JavaScript Object Notation. ## Verdict and Threat Intel Improvements - **Single case verdict** — One verdict appears in the top header, so AI and manual verdicts are not shown as competing values. - **AI verdict** — The AI verdict is the default display. It includes the AI logo and the confidence score. - **Manual override** — A drop-down list sets a manual verdict, updates the icon, and hides the confidence score. - **Threat Intel widget** — Shows the intelligence verdict together with status, risk score, and the related threat intelligence records. - **AI analysis** — When fully expanded, the **Threat Intelligence** widget shows **AI Analysis** and **Improvements**, and the **Case Summary** widget shows **AI Verdict Analysis** and **Improvements**. The two widgets read different fields. ## Widget Consolidation and Separation - **Case Summary and Case Snapshot** — The **Case Summary** card on the **Case Investigation** tab and the **Case Snapshot** tab use separate widgets. - **Investigation and remediation** — These are two widgets, so investigation steps stay separate from remediation actions. - **Automation** — Playbook and triage-rule creation is in its own widget. - **MITRE ATT\&CK and D3FEND** — One widget combines MITRE ATT\&CK and D3FEND. Automation maps attack techniques to the relevant D3FEND techniques. - **Manual remediation** — Playbook button triggers are on the front of the case. They were previously on the Support tab. - **Analyst investigation** — Analyst investigation and notes have their own card. ## Investigation Types - **Available types** — Three investigation types are available: - **AI Assisted** — Analyst and AI collaboration. The analyst stays in the loop. - **Agentic** — Analyst Agent. An AI agent runs the investigation. - **Automated** — Investigation Playbook. Playbooks and routing rules run the investigation. **Automated** appears in the menu only after the case timeline records **Case Investigation Type Update - Automated**. - **Where it appears** — The investigation type is visible in both the investigation widget and the sidebar widget. For more information, see [Case Management (CASE)](docId\:sDpESfT6Lsyz0zfrn_hok). ## Additional Changes ### AI Alert Ingestion Content The release includes the updated AI Alert Ingestion content. On Alert Schema Store, edit **AI Mapping Translation (Alert → TEDs)** beside **Example Raw Alert**. TEDs is the on-screen name for Turbine Schema. The `ai_mapping`, `schema_sample`, and `schema_fingerprint` fields stay read-only. For more information, see [Review or Edit an Alert Mapping](/solutions/ai-soc-ingestion#review-or-edit-an-alert-mapping). ### Action Required: Enable Date/Time Field Trigger Customers who use SLA breach notifications or case correlation need Date/Time Field Trigger enabled. If you do nothing, SLA Exceeded Notification stays idle when SLA Target is reached, and Case Correlation (Time Delay) stays idle when the Case Correlation Date/Time is reached. The record shows no error. Enable Date/Time Field Trigger before you rely on those playbooks. For more information, see [Case Management (CASE)](docId\:sDpESfT6Lsyz0zfrn_hok). ### Action Required: Set SLA Hours After Upgrade Customers who set SLA hours by source (Alert, Phishing Triage, or Manual) need to set the new inputs before they rely on a custom window. Those source inputs are not in this package. If you do nothing, new cases use these package defaults: - **Baseline:** 6 hours - **P0:** 2 hours - **P1:** 4 hours - **P2:** 5 hours - **P3:** 6 hours - **P4:** 7 hours Open **Orchestration** → **Assets** → **AI SOC General Configuration**, and set Baseline and SLA by Priority. For more information, see [Configure Custom Assets](docId\:qDCKIJLolS_7DWZJgRBqK). ### Action Required: Add Collect Playbook Outputs to Older Investigation Playbooks Customers who keep an investigation playbook created before AI SOC 26.2.0 need to add **AI SOC - Collect Playbook Outputs** immediately before the verdict component. Set Playbook Run ID to `$run.id`. If you do nothing, a playbook that calls multiple components inside a loop may send only the last component output to Hero AI. Playbooks created from current AI SOC content already include this component. ### SLA by Priority and Breach Notification SLA Target stores the date and time when the SLA window ends. SLA Exceeded Notification runs at that time and sends an in-app notification to the current owner. After that notification succeeds, the playbook writes SLA Breached on Case Timeline and sets Requires Attention. SLA Target is cleared when Status is Closed. Case Correlation (Time Delay) runs when the Case Correlation Date/Time is reached. Both playbooks run only when Date/Time Field Trigger is enabled. ## Known Issues - **Unfinished Comment Warning Appears When You Leave a Case Without Changes** — On some cases, when you open the case and then go back without editing anything, a dialog warns about an unfinished comment and asks you to leave or cancel. This does not happen on every case. It most often occurs after you click certain fields in the case. If you made no changes, select **Leave** to close the case.