> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/automations/playbooks/accelerate-playbook-development-using-the-agentic-playbook-builder-preview.md).

# Accelerate playbook development using the Agentic Playbook Builder (preview)

Use the Agentic Playbook Builder (preview) in Cortex AgentiX to create, optimize, and troubleshoot playbooks using natural language and security best practices.

The Agentic Playbook Builder leverages the Automation Engineer agent to enable security teams to create, optimize, and troubleshoot playbooks using natural language and security best practices.

{% hint style="info" %}

### Note

During the private preview phase, consumed Compute Units for the Agentic Playbook Builder are free, they will not be charged against your license usage.
{% endhint %}

### Agentic Playbook Builder capabilities in Cortex AgentiX

* **Creating new playbooks**\
  Generate functional, structured playbooks from a natural language prompt. During this preview phase, the builder automatically selects the best options from your installed integrations and follows security best practices to optimize performance. It does this by using its built-in knowledge of the platform's automation framework, including the required SDK and your existing playbooks. (Full access to the Marketplace catalog will be introduced at GA).\
  Example:\
  “Create a playbook that is triggered by a new network alert containing an IP address. First, run standard IP enrichment and threat intelligence lookups to triage the IP and check for associated malware. Next, add a conditional task to evaluate if the IP is marked as malicious. If it is malicious, send an email to <IT@palo.com>. If benign, close the incident.”
* **Maintaining and optimizing existing playbooks**\
  Modify existing tasks, logic, triggers, or integrations using conversational follow-ups. By dynamically learning tenant environment details, active instances, and custom automations, the builder redefines existing playbooks to continuously fix bugs and improve execution efficiency while scanning available automations to highlight potential design flaws.\
  Example:
  * “Add error handling to this flow”
  * “In the 'Is Malicious' condition, change the target email address to <security-ops@palo.com>.”
* **Learning and extracting information (querying and explaining)**\
  Ask questions in the prompt to understand complex workflow logic, break down custom scripts, or troubleshoot specific tasks. The builder allows analysts to query the platform and extract real-time data across any playbook, integration, or platform automation capability, including details from out-of-the-box system playbooks.\
  Example:
  * "Explain the logic behind the conditional branch in this playbook."
  * "How do I use the AgentiX SDK to add a custom header to the outgoing email task in this workflow?"

{% hint style="info" %}

### Note

The Automation Engineer agent is available with the Cortex Agentic Assistant, for users with playbook view/edit permissions and Interact with agent enabled.

For more information, see [Agentic Assistant role-based access control](broken://pages/2OtIgAqTyZdapM4BdFpC).
{% endhint %}

### Use the Agentic Playbook Builder in Cortex AgentiX

1. Navigate to **Investigation & Response** → **Automation** → **Playbooks**.
2. Create a new playbook or open an existing one to enter the Playbook Editor.
3. Click the **Agentic Assistant** icon. The **Agentic Assistant** pane opens with the Automation Engineer agent automatically selected.
4. In the chat interface, enter a natural language prompt describing the automation you want to build or the change you want to make.\
   The agent automatically uses the active playbook as context. Any request to create, modify, or query details applies specifically to that playbook.\
   Example:
   * "Build a playbook that is triggered by a phishing alert, extracts the sender's domain, and checks its reputation using VirusTotal. If malicious, block the domain in Okta and notify the security team via Slack."
   * “Create a playbook that is triggered by a new network alert containing an IP address. First, run standard IP enrichment and threat intelligence lookups to triage the IP and check for associated malware. Next, add a conditional task to evaluate if the IP is marked as malicious. If it is malicious, use the mail integration to send an email to <IT@palo.com> containing the IP address, the alert details, and the associated malware context. If it is benign, close the incident.”
5. Click the submit arrow or press **Enter** to submit the prompt.\
   The Agentic Assistant then displays:
   * The plan describing the steps taken, including retrieving relevant integrations and generating playbook logic.
   * A playbook preview card showing playbook metadata, task counts, revision numbers, and visual expansion options.
6. Refine the logic interactively by providing additional conversational instructions.\
   You can for example provide additional instructions such as "Add a 10-minute delay before the Slack notification".\
   If the agent cannot find a specific command or script for a task, it creates a placeholder task in the editor for you to complete manually.
7. Click **Use this revision** to push the AI-generated logic to the Playbook Editor.\
   Revisions can only be applied while in Edit Mode. If you have unsaved manual changes, the system prompts you to confirm before overwriting them.

### Track AI-assisted Cortex AgentiX playbook development

To help maintain visibility into which automations were created or modified by AI:

* Any playbook generated or significantly modified by the agent is automatically assigned the **AI Assisted** tag.
* The Agentic Assistant maintains a history of your conversation and revisions, allowing you to compare versions or revert to an earlier state.

### Agentic Playbook Builder best practices

You do not need a perfect prompt on the first try. Use iterative feedback to fine-tune your playbook.

* **Automation best practices**\
  **T**he builder guides creation using Cortex AgentiX security best practices to ensure optimal performance and error prevention.
* **Best match automation**\
  The builder analyzes thousands of marketplace components to ensure the best fit for your task.

Example:

* "Add error handling for the VirusTotal task."
* "Change the notification channel from Slack to Microsoft Teams."
* "Ensure the playbook only triggers if the severity is High."

### Known limitations

During the private preview phase, keep the following temporary performance guidelines and feature constraints in mind to ensure an effective evaluation of the Agentic Playbook Builder.

* Playbook generation and edit speeds\
  Generating or modifying playbooks takes approximately 3 minutes for small playbooks, 5 minutes for medium playbooks, and 8 minutes for large playbooks.
* Marketplace scope\
  The agent currently accesses installed content only. Full access to Marketplace will be introduced at General Availability (GA).
* Interactive clarification\
  Guided workflows to help refine incomplete prompts will be added at GA.
* SOP / SOW file ingestion\
  Direct file upload for Statements of Work (SOW) and automation guidelines will be available at GA.
* Compute Unit metrics\
  Usage tracking metrics for Compute Units will be available in upcoming releases.
* Knowledge customization\
  Adding custom files links to agents is not available for the private preview phase.

<br>


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/automations/playbooks/accelerate-playbook-development-using-the-agentic-playbook-builder-preview.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.