> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/automations/playbooks/accelerate-playbook-development-using-the-agentic-playbook-builder-preview/agentic-playbook-builder-prompt-examples.md). # Agentic Playbook Builder prompt examples Use Agentic Playbook Builder prompt examples to generate Cortex AgentiX security response playbooks for triage, enrichment, and remediation. The following table provides some use case scenarios and the corresponding prompts used to generate automated response playbooks within Cortex AgentiX. | Use case scenario | Prompt | | ----------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Triage IP and notify IT of malware | "Create a playbook that triggers on a new network alert containing an IP address. First, run standard IP enrichment and threat intelligence lookups to triage the IP and check for associated malware. Next, add a conditional task to evaluate if the IP is marked as malicious. If it is malicious, use the mail integration to send an email to containing the IP address, the alert details, and the associated malware context. If it is benign, close the incident." | | Verify TOR connection and retrieve Machine ID | "Create a playbook that triggers on a network alert indicating potential TOR usage. First, extract the source IP, destination IP, and user details from the alert. Verify the connection by checking if the destination IP is a known TOR exit node or if the application signature is explicitly flagged as TOR. Next, add a conditional task: if TOR usage is confirmed, retrieve the endpoint's Machine ID or hostname associated with the user. Finally, use the mail integration to send an email to IT containing the username, the confirmed TOR connection details, and the Machine ID. If it is not TOR, close the incident." | | Evaluate and block malicious users or domains | "Create a playbook that triggers on an alert containing a username and a domain. First, run standard enrichment: check the domain's reputation using threat intelligence, and retrieve the user's risk profile or Active Directory status. Next, add a conditional task to evaluate if blocking is required based on whether the domain is flagged as malicious or the user risk score is critically high. If a block is required, use the mail integration to send an email to IT containing the user details, the suspicious domain, the threat context, and explicit instructions on whether to block the domain, suspend the user, or both. If the activity is benign, close the incident." | | Advanced Parallel Triage: Suspicious User + Domain Activity | "Create a security-response playbook named 'Suspicious User + Domain Activity — Automated Triage'. 1. Trigger: Require 'username' and 'domain' inputs with initial validation. 2. Parallel Enrichment: Concurrently run Task A (Domain Reputation via !domain), Task B (AD Lookup via !ad-get-user), and Task C (User Risk via identity integration). Each must have error handling to assign safe defaults. 3. Logic: Use a conditional task 'Is Blocking Required?' with three branches: YES (Domain score >=70/malicious OR User risk >=80/high/critical), NO (both clean), and REVIEW (ambiguous/defaults used). 4. Actions: For YES, send email to with labeled sections for User, Domain, Context, and Recommended Action (Block/Suspend/Both), then set severity to High. For NO, close as False Positive. For REVIEW, assign a manual task with a 4-hour SLA. All branches must converge to a single END node." | --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation by asking a question. Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters: ``` GET https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/automations/playbooks/accelerate-playbook-development-using-the-agentic-playbook-builder-preview/agentic-playbook-builder-prompt-examples.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.