Cortex AgentiX use cases

Recommended prompts to automate your SOC in Cortex AgentiX.

Discover how Cortex AgentiX can streamline security operations through these use cases.

Chat prompt examples

Conversation starters in the Cortex Agentic Assistant provide common prompts for relevant actions and information.

For example, a SOC analyst might see these starters:

• What are the top issues I should prioritize today?
• Show me all issues with an overdue SLA
• Which automations are waiting for my input?
• Clean up all expired indicators.

You can also use prompts such as:

• Read this Unit42 blog and get all the CVEs. For every critical CVE found, check if my assets are vulnerable and isolate them.
• List recent security issues with high severity and an affected hostname that includes 'server'.
• Summarize the latest security issues from the past 24 hours
• How do I make a loop inside a playbook?
• What is the riskiest unresolved issue affecting our critical infrastructure?
• Show recent SSO-related issues
• Investigate this phishing issue and determine the source of the email and block any malicious indicators.
• Create a pie chart of the top 10 targeted assets over the last 7 days.
• Show critical assets by region in a bar chart.
• Create a line chart to show the trend of critical security issues over the past month.

---

Slack interaction with the Agentic Assistant example

Slack chat lets your team interact with agents in its daily workflow. Your team does not need to sign in to Cortex AgentiX. For setup details, see Chat with the Agentic Assistant from Slack.

This example shows how to monitor shift priorities, track SLAs, and review pending automations from Slack.

1

Initiation

Open your team's Slack channel. Tag @Cortex Assistant and ask, "What are the top issues I should prioritize today, and show me all issues with an overdue SLA?"

2

Agent selection

The bot displays available public agents. Select the agent that handles the request.

3

Status update

The agent replies in the thread with the highest-priority issues. It also lists automations awaiting user input.

Only the initiator can use the active session. Other channel members receive an access denied message.

4

Handoff

The session can remain open for up to two weeks. To end it sooner, enter @Cortex Assistant reset.

Another team member can then start a new session. The agent reads the last five thread messages for context. For example, they can ask, "Assign the first overdue issue from that summary to me."