> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-agentix/learn-about-cortex-agentix/agentic-ai-in-cortex-agentix/manage-cortex-agentix-agents.md).

# Manage Cortex AgentiX agents

In Cortex AgentiX, you can interact with agents in the Cortex Agentic Assistant chat to automate case and issue investigation and response. Agents create and execute plans, which are sequences of actions (such as playbooks, scripts, and commands) designed to fulfill users' requests.

### **Agent selection**

Each agent is designed with specific goals and functions to help you address different aspects of security operations.

Within the chat prompt, click the agent icon to select available agents. As you hover over each agent, you can see a brief description of the agent and its primary focus. Select the agent that best suits your current task or investigation.

You can select from system agents, public agents other users have created, or agents you have personally built and configured.

Here are some examples of the specialized system agents you may encounter, each relevant for specific security workflows:

| Agent Type             | Description                                                                                                                                                                                                                                                               |
| ---------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| IT                     | Automates identity lifecycle enforcement, real-time containment on endpoints and networks, vulnerability and patch governance, asset intelligence upkeep, and end-to-end incident workflow coordination—delivering policy-driven remediation across the enterprise.       |
| Email Investigation    | Automates the full lifecycle of email-borne threat response, spanning mailbox search, forensic collection, analysis, containment, and incident closure across all major mail platforms and security layers.                                                               |
| Threat Intel           | Gathers fresh threat data, enriches indicators and vulnerabilities, links them to past or current incidents, and publishes clear briefings so the whole SOC acts on the latest attacker tactics.                                                                          |
| Help Center            | Provides answers to questions by referencing product documentation. If further assistance is needed, the agent assists you in opening a support case.                                                                                                                     |
| Network Security       | Audits next-gen firewalls for vulnerabilities, expired certificates, outdated software, risky or unused rules, capacity limits, and other misconfigurations. It searches logs for threats and then automates or guides clean-ups and upgrades to keep the network secure. |
| EndPoint Investigation | Unifies host-level containment, forensic collection, and remediation across all major EDR/XDR platforms while feeding evidence and status into the SOC's ticketing and collaboration stack.                                                                               |
| Automation Engineer    | Streamlines automation by generating and updating Python scripts from natural-language prompts, applying security best practices, and letting you explore or explain any part of the code.                                                                                |

### **Agent Management**

Both actions and agents are managed in the **Agentic Assistant Hub** (go to **Agentic Assistant** in the main menu and click the side panel icon ![expandmenuicon.png](/files/eURikbGfpR4js2yeIcCM) to view the **Agentic Assistant Hub** menu item). In the **Agentic Assistant Hub**, you can do the following:

* Register scripts, commands, and AI prompts as custom actions. Items that are registered as custom actions can be assigned to agents and used in plans. For more information, see [Manage actions](/cortex-agentix/configure-cortex-agentix/configure-the-cortex-agentic-assistant/agents-hub/manage-actions.md).
* View, enable, and disable system actions and edit existing custom actions.
* Enable and disable system agents. System agents have access to system actions that are assigned to the agent.
* Create, edit, and delete custom agents. Custom agents can include system actions as well as custom actions. Custom agents can be private for a user or available to all users.

  <div data-gb-custom-block data-tag="hint" data-style="info" class="hint hint-info"><h3>Note</h3><p>When users create custom agents, the agents have the same or fewer permissions as the user. For example, if a user has sufficient permissions to isolate an endpoint, the user's agent can also isolate an endpoint.</p><p>All users have access to all system agents and all public agents, but plan execution is limited by the permissions of the individual user. A system or public agent may include actions that the user does not have permission to execute.</p></div>

For more information and to configure actions and agents, see [Agentic Assistant Hub](/cortex-agentix/configure-cortex-agentix/configure-the-cortex-agentic-assistant/agents-hub.md).


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://cortex-docs.paloaltonetworks.com/cortex-agentix/learn-about-cortex-agentix/agentic-ai-in-cortex-agentix/manage-cortex-agentix-agents.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.