Swimlane

The Swimlane Marketplace has connectors for Microsoft, AWS, Cisco, CrowdStrike, Palo Alto Networks and others. An Ingestion Agent integrates with any API instantly, and playbooks act across the connected stack after approval. Turbine has connectors for more than 30 vendors, Splunk among them, and every plan includes unlimited integrations. The Threat Intelligence Agent pulls together sources such as VirusTotal and Recorded Future. Hero AI tools reach the connected stack through an MCP server that calls the Turbine engine.

SourceSwimlane, swimlane.com/swimlane-turbine, /platform/enterprise-packaging and swimlane.com/news/ai-agents-case-managementread 2026-10-05

Swimlane calls Turbine Canvas the world's first ultra simple playbook and AI agent builder. Customers build playbooks with agents as steps, and they decide how alerts are routed between deterministic playbooks and deep and expert agents. Each alert goes to an existing playbook, an AI assisted investigation or a fully agentic one, depending on how complex it is. Hero AI agents can be dragged into a playbook as steps. In a playbook step, the Hero AI action takes a plain language prompt and decides which of its configured tools to call and when.

SourceSwimlane, swimlane.com/swimlane-turbine, /product/ai-soc and docs.swimlane.com Hero AI Native Actionread 2026-10-05

Deep agents use MCP and methodical reasoning, and the AI SOC collects data for each investigation. The Investigation Agent uses identified threats, past investigations and knowledge base articles to plan an investigation and write the playbooks that carry it out. The Verdict Agent reads current, linked and historical case context, including knowledge base articles, threat intelligence and analyst notes. Swimlane does not say how a customer adds its own articles or how that knowledge store is kept up to date.

SourceSwimlane, swimlane.com/product/ai-soc and swimlane.com/news/ai-agents-case-managementread 2026-10-05

The AI SOC requires explicit human approval before any state changing action the organization has not already trusted to automation. Analysts can review, change or rebuild any plan the AI writes before it runs, and they can pause, reject or roll back a recommendation at any point. When Hero AI is unsure, it hands the case to a person instead of guessing. In the builder, a component Hero AI drafts stays on the canvas for review until someone saves it.

SourceSwimlane, swimlane.com/product/ai-soc and docs.swimlane.com Create and Modify Components with Hero AIread 2026-10-05

Swimlane Cloud holds SOC 2 Type II, ISO/IEC 27001, 27017, 27018 and 27701 and CSA STAR, with a FedRAMP High GOV region, globally enforced two factor authentication, SAML SSO and role based access down to field level, plus SCIM provisioning and audit logging. It also holds SOC 1 Type II and ISO 9001, and Swimlane cites ISO 42001 and FedRAMP High authorization for Hero AI.

Role based access covers workspaces, dashboards, reports, applications and records, and sign in also works through LDAP and Active Directory. Data is encrypted at rest and in transit, and credentials are kept in a secure database. Only a few employees can reach production systems, and contractors have no access to customer production data.

SourceSwimlane, swimlane.com/solutions/swimlane-cloud and swimlane.com/platform/airead 2026-10-05

For every investigation, the AI SOC keeps a plain language record of the agent's reasoning, covering what data it collected, what logic it applied and what conclusion it reached, which can be exported for audit. Turbine also keeps audit logs. The Investigation Agent writes a summary and a timeline for each case. Each Hero AI action returns a request ID, a finish reason and token counts along with its result, and dashboards and reports track how the security team is performing.

SourceSwimlane, swimlane.com/product/ai-soc, swimlane.com/news/ai-agents-case-management and docs.swimlane.com Hero AI Native Actionread 2026-10-05

Case management is the system of record, where case data sits in a set structure. The Verdict Agent and the Investigation Agent read historical cases and past investigations as they work, but Swimlane does not say what an agent keeps between runs, for how long or for whom. Case records count against a yearly allowance, from 100,000 records on the Starter plan to 1 million on Elite.

SourceSwimlane, swimlane.com/product/ai-soc, /platform/ai and /platform/enterprise-packagingread 2026-10-05

Swimlane runs in the cloud, on premises or air gapped, and Swimlane Cloud is offered in eight regions, the US, UK, EU, Canada, Singapore, Tokyo, Australia and a dedicated FedRAMP High GOV region. The cloud service runs on AWS. In an on premises install, the tools Hero AI calls run inside the customer's own cluster. Setup takes two weeks on the Starter plan and four weeks on the larger plans.

SourceSwimlane, swimlane.com/platform/enterprise-packaging, /swimlane-turbine and docs.swimlane.com Hero AI Native Actionread 2026-10-05

Hero AI ships named agents (Playbook Generator, Intelligent Visualization, Ingestion) alongside deep and expert agents, and the Swimlane Marketplace carries prebuilt agents, playbooks and connectors that drop into playbooks. Hero AI has seven agents in all, adding Agentic Investigations, Verdict, Threat Intelligence, and MITRE ATT&CK and D3FEND.

The Verdict Agent gives a verdict on a case the way an analyst would, and the MITRE agent maps alerts to standard attack techniques. The Playbook Generator asks clarifying questions as it builds. NIST aligned action recommendations sort each response into containment, eradication, recovery and hardening.

SourceSwimlane, swimlane.com/platform/ai, /product/ai-soc and swimlane.com/news/ai-agents-case-managementread 2026-10-05

Incoming alerts are routed to playbooks and AI SOC investigations through the Active Sensing Fabric ingestion layer, so work starts on an alert with no person launching it. Routing checks every alert and sends it to a playbook, an AI assisted investigation or a fully agentic one. The 26.4 release added custom dynamic responses to webhooks. Analysts can also start work from Hero AI chat, which finds and runs components marked visible to Hero AI.

SourceSwimlane, swimlane.com/swimlane-turbine, /product/ai-soc and docs.swimlane.com Create and Modify Components with Hero AIread 2026-10-05

Customers select the AI model for each agent, including their own model, based on performance and availability. Any AWS Bedrock model can run a Hero AI agent, and customers can bring their own model from Anthropic and select Bedrock models. The Hero AI playbook action defaults to Claude Haiku 4.5, can switch to Sonnet or Opus models, and also offers OpenAI and Qwen models. Each plan includes a Hero AI credit allowance, from 37,500 credits on Starter to 262,600 on Elite.

SourceSwimlane, swimlane.com/product/ai-soc, /platform/ai, /platform/enterprise-packaging and docs.swimlane.com Hero AI Native Actionread 2026-10-05

The Turbine API uses personal access token authentication and has a generic request action for any endpoint, Turbine Canvas supports full code, and SCIM provisioning is supported. The API connector accepts a username and password or a personal access token, and its request action takes any method and path.

Hero AI actions can return JSON shaped to a schema the builder defines, and the Plus plan and above add an App Builder and a Git repository. Hero AI calls its tools through an MCP server that talks to the Turbine engine, and the deep agents use MCP as clients, but there is no MCP server for outside agents to connect to.

SourceSwimlane, docs.swimlane.com Swimlane Turbine API connector and Hero AI Native Actionread 2026-10-05

There is no way to run agents or playbooks against test cases and score the results. The Playbook Generator writes and changes playbooks from prompts, and it does not test them. Swimlane's accuracy and savings figures come from customer stories, such as 100% recommendation accuracy at one customer and 128 of about 180 daily cases closed at a healthcare customer.

SourceSwimlane, swimlane.com/product/ai-soc and swimlane.com/platform/airead 2026-10-05

Automation acts through API connectors, and no agent operates a browser or desktop. Hero AI works through playbook actions and tools that call the Turbine engine, and the Ingestion Agent reaches new data sources through their APIs. None of these opens a web page or works a screen.

SourceSwimlane, swimlane.com/swimlane-turbine and docs.swimlane.com Hero AI Native Actionread 2026-10-05