# Swimlane Turbine Adds Custom Detections and Two-Way MCP Support

The October release gives security teams more control over what starts an investigation and how AI assistants can invoke their workflows.

By Paras Madan | 2026-10-29


Swimlane announced new Turbine capabilities on October 28, including customer-defined detections, two-way MCP support and a Hero AI Application Builder Agent. Swimlane says the features are generally available. The useful change is that security teams can define more of the signals that reach their AI security operations center, rather than only processing existing alerts.

## What customer-defined detection changes

The [company announcement](https://www.businesswire.com/news/home/20261028898168/en/) says teams can run their own detection logic across data available to Turbine and send the resulting alerts to Swimlane AI SOC. A single action can process tens of thousands of records across parallel compute nodes.

For an operator, that raises a different question from how well an AI system investigates an alert: did the right activity create an alert in the first place? An excellent investigation cannot help with a pattern that never enters its queue.

A hypothetical company might want to distinguish an approved AI account from an unapproved one using its own employee and service records. That is a local policy question. The usefulness of custom detection depends on whether the necessary records are available and whether the rule captures the distinction reliably.

## How Turbine's two-way MCP connection works

Turbine can consume tools from third-party MCP servers. It can also expose governed components, including multi-step playbooks, to external assistants under existing role-based access controls. The Application Builder Agent proposes changes from natural-language requests, but edits remain unsaved until reviewed and accepted.

The [official 26.5 release overview](https://swimlane.com/resources/videos/swimlane-turbine-oct-26-release-overview/) groups these capabilities together. They address related work: creating a detection, connecting the tools an investigation needs and adapting the application around it.

**Two-way connectivity creates two permission reviews.** One covers what the security agent can access outside Turbine. The other covers what an external assistant can invoke inside it. Treating both as simply enabling MCP would miss that distinction.

## Availability does not remove deployment work

Swimlane's [AI SOC troubleshooting documentation](https://docs.swimlane.com/solutions/troubleshooting) makes the operational dependencies clear. Hero AI features require tenant enablement and appropriate permissions. Investigation planning can also fail because of missing fields, service availability or oversized evidence sets.

The documentation warns that opening the same playbook in multiple builder sessions can result in one save overwriting another. These are general platform considerations, not evidence of a defect introduced in the October release. They matter because generating a workflow is only part of getting a dependable workflow into production.

For an existing customer, I would evaluate one detection end to end: supply representative records, check the false positives, inspect the resulting investigation and verify the permissions on any proposed action. A successful demo should include a benign case that does not trigger a response, not only a malicious example that does.

## The measure that matters after rollout

More custom rules can improve coverage, but they can also create more alerts to maintain. The useful measure is whether the organization catches an important local condition that its previous workflow missed, without increasing unnecessary investigations beyond what its team can handle.

That makes the next step a detection-quality exercise as much as an AI evaluation. The customer still has to decide what deserves attention before asking an agent to act on it.

I'm Paras. I work at the intersection of AI, engineering and distribution.

I help technical teams explain complex AI launches in clear stories that developers and enterprise buyers can use.

[Book a 30-minute call](https://cal.com/paras-madan/30min).