> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/automations/agentic-response-preview.md). # Agentic Response (Preview) Use Agentic Response in Cortex AgentiX to trigger AI agents from automation rules. Agentic Response (preview) allows you to trigger AI agents directly from automation rules to handle non-linear security scenarios. While complex, highly deterministic workflows are still best suited for standard playbooks, Agentic Response provides a solution for less lengthy and less predictable workflows. By integrating AI intelligence directly into SOC workflows, agents can adapt to unpredictable scenarios without requiring you to program every condition. Agentic Response is effective for targeted, end-to-end flows where agents can reason through tasks, reducing the need to build and maintain highly extensive workflow configurations. Potential use cases include: * **Phishing forensics (deep hunt & blast radius):** Converting threat intel into XQL queries to autonomously map recipient and host connections to attacker infrastructure. * **Data exfiltration (containment & L1 remediation)**: Automatically pulling in relevant data points. * **Cloud misconfiguration (dynamic playbook routing)**: Analyzing root causes, such as unauthorized access, and dynamically choosing which specialized, pre-approved security playbook to trigger based on the findings. ### Configure Agentic Response agents and prompts The foundation of Agentic Response is defining exactly what the agent should do when the automation rule is triggered. You initiate this workflow by selecting an appropriate agent and providing it with a dedicated prompt tailored to your specific use case. Designed for rapid, fully autonomous execution, the agent runs independently to complete its tasks without requiring interactive chat or user follow-up. All of the inputs the agent needs must be provided entirely within the prompt inputs or gathered directly from the issue. When triggered, the agent automatically ingests relevant data points from the issue, eliminating the need to manually map context fields for every run. By default, the agent can view basic details such as the issue ID, name, description, severity, and category name. If you need the agent to evaluate additional data points, you can configure them as inputs to the prompt. This allows you to create dynamic, context-aware prompts by linking placeholders directly to your existing issue fields. ### Test Agentic Response prompts Since agent execution is completely autonomous, thoroughly testing the prompt is a critical step before deploying the automation rule. Testing allows you to verify that the agent's reasoning and execution plan align with your desired outcome. ### Monitor Agentic Response activity and approvals After an agent is triggered, you can view its step-by-step reasoning, execution plan, and the full conversation directly from the **Resolution** tab on an issue, or from the side panel in the case **Resolution Center**. To ensure you maintain human-in-the-loop control over your environment, agents do not automatically execute any actions marked as sensitive. If an agent requires a sensitive action, it pauses execution and generates a pending task in the case **Resolution Center**, requiring an analyst to manually approve or deny the action before the agent continues. The **Issues** table includes the name of the agent running on an issue, as well as the status (Running, Pending, Done, or Error). The **Resolution Center** for a case displays agent pending tasks, errors, and completed runs. Agent runs are logged in the **War Room** and also appear in audit logs. Automation rules can trigger AI agents when issues are created that meet your specific criteria. To implement Agentic Response capabilities, [Create an automation rule](/cortex-agentix/configure-cortex-agentix/automations/create-an-automation-rule.md). --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation by asking a question. Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters: ``` GET https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/automations/agentic-response-preview.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.