Manage Cortex AgentiX agents

Learn about personal and system agents in Cortex AgentiX.

In Cortex AgentiX, you can interact with agents in the Cortex Agentic Assistant chat to automate case and issue investigation and response. Agents create and execute plans, which are sequences of actions (such as playbooks, scripts, and commands) designed to fulfill users' requests.

Agent selection

Each agent is designed with specific goals and functions to help you address different aspects of security operations.

Within the chat prompt, click the agent icon to select available agents. As you hover over each agent, you can see a brief description of the agent and its primary focus. Select the agent that best suits your current task or investigation.

You can select from system agents, public agents other users have created, or agents you have personally built and configured.

Here are some examples of the specialized system agents you may encounter, each relevant for specific security workflows:

Agent Type	Description
IT	Automates identity lifecycle enforcement, real-time containment on endpoints and networks, vulnerability and patch governance, asset intelligence upkeep, and end-to-end incident workflow coordination—delivering policy-driven remediation across the enterprise.
Email Investigation	Automates the full lifecycle of email-borne threat response, spanning mailbox search, forensic collection, analysis, containment, and incident closure across all major mail platforms and security layers.
Threat Intel	Gathers fresh threat data, enriches indicators and vulnerabilities, links them to past or current incidents, and publishes clear briefings so the whole SOC acts on the latest attacker tactics.
Help Center	Provides answers to questions by referencing product documentation. If further assistance is needed, the agent assists you in opening a support case.
Network Security	Audits next-gen firewalls for vulnerabilities, expired certificates, outdated software, risky or unused rules, capacity limits, and other misconfigurations. It searches logs for threats and then automates or guides clean-ups and upgrades to keep the network secure.
EndPoint Investigation	Unifies host-level containment, forensic collection, and remediation across all major EDR/XDR platforms while feeding evidence and status into the SOC's ticketing and collaboration stack.
Automation Engineer	Streamlines automation by generating and updating Python scripts from natural-language prompts, applying security best practices, and letting you explore or explain any part of the code.

Agent Management

Both actions and agents are managed in the Agentic Assistant Hub (go to Agentic Assistant in the main menu and click the side panel icon to view the Agentic Assistant Hub menu item). In the Agentic Assistant Hub, you can do the following:

• Register scripts, commands, and AI prompts as custom actions. Items that are registered as custom actions can be assigned to agents and used in plans. For more information, see Manage actions.
• View, enable, and disable system actions and edit existing custom actions.
• Enable and disable system agents. System agents have access to system actions that are assigned to the agent.
• Create, edit, and delete custom agents. Custom agents can include system actions as well as custom actions. Custom agents can be private for a user or available to all users.

  Note

  When users create custom agents, the agents have the same or fewer permissions as the user. For example, if a user has sufficient permissions to isolate an endpoint, the user's agent can also isolate an endpoint.

  All users have access to all system agents and all public agents, but plan execution is limited by the permissions of the individual user. A system or public agent may include actions that the user does not have permission to execute.

For more information and to configure actions and agents, see Agentic Assistant Hub.