> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/automations/automation-in-cortex-agentix.md). # Automation in Cortex AgentiX Automation enables you to improve efficiency and response times by performing actions on one or more issues, either automatically in response to predetermined conditions or manually triggered during your investigation workflow. In Cortex AgentiX, you can use playbooks, agents, scripts, commands, and Quick Actions to streamline operations, accelerate triage, and boost productivity. The **Automation Insights** dashboard provides a high level overview of your automations. * **Playbooks** Playbooks enable you to organize and document security monitoring, orchestration, and response activities. Playbooks are self-contained, fully documented prescriptive procedures that query, analyze, and take action based on the gathered results. Playbooks are built from regular tasks and sub-playbooks. Playbook tasks can run out-of-the-box or custom scripts and integrations to communicate with third-party systems. You can use out-of-the-box playbooks as is, or customize them according to your requirements. You can also reuse individual playbook tasks as building blocks for new playbooks, saving time and streamlining knowledge retention. Playbooks can run automatically on issues based on automation rules, run automatically by jobs on a schedule or based on a delta, or can be run manually on one or more issues.

You can build end-to-end automation workflows from within the playbook editor, including creating automation rules, configuring integration instances, and creating and editing tasks. For more information, see Playbooks.

* **Scripts and commands** Cortex AgentiX includes built-in commands, as well as commands and scripts from the core content packs. In addition, when you adopt playbooks, any necessary scripts and integrations for the playbook are automatically downloaded. You can also write your own scripts or edit existing scripts. Scripts and commands can be used in playbook tasks or run manually from the **War Room**. * **Quick Actions** Quick actions are single commands that enable you to respond rapidly without requiring complex playbooks. Quick Actions can be run automatically on issues based on automation rules, or run manually on one or more issues. **Automation rules** Automation rules enable you to run playbooks, Quick Actions, or agents automatically on issues, based on preset criteria. Automation rules follow a WHEN / IF / THEN structure. For example, WHEN an issue is created, IF the severity is critical, THEN set the case assignee to a specific analyst. For more information, see [Create an automation rule](/cortex-agentix/configure-cortex-agentix/automations/create-an-automation-rule.md). **Manually trigger automation** Playbooks and Quick Actions can also be run on demand. For more information, see [Run an automation on an issue](/cortex-agentix/detect-investigate-and-respond-to-threats/investigation-and-response/investigate-issues/run-an-automation-on-an-issue.md). --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/automations/automation-in-cortex-agentix.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.