> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-agentix/learn-about-cortex-agentix/key-components-and-concepts.md). # Key components and concepts Cortex AgentiX uses the following components and concepts: | Name | Description | | ---------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Actions | Actions wrap diverse capabilities (such as playbooks, scripts, and commands, and AI prompts) to make them accessible and executable by an agent. You can use out-of-the-box system actions or register new actions. | | Agent |

An agent is a virtual persona that creates and executes domain specific plans, at your request, to assist in your day-to-day SOC operations. An agent has roles and permissions that provide guardrails. Each agent is assigned a collection of actions that it can use as part of plans.

The agent chooses the most relevant actions to fulfill a user's request. Agents process user requests, create plans, and orchestrate actions based on their goals and permissions (RBAC and SBAC).

You can use the following types of agents:

Some agents provide relevant chat conversation starters under the chat prompt. For examples of conversation starters, see Cortex AgentiX use cases.

Note

Agents are bound by the same rules and robust permissions as a human user. In addition, you can mark actions that make real-world changes in production systems as sensitive, requiring a quick manual review and confirmation, ensuring peace of mind before critical system changes are made.

| | Automation Rules | Automation rules allow the system to automatically respond to events by defining trigger conditions and desired actions, such as playbooks and Quick Actions, to perform once the condition is met. | | Quick Actions | Quick Actions are preset single commands that enable you to automate basic tasks such as creating tickets in third-party systems, sending Slack messages, and changing issue severity. | | Playbook | Playbooks are a series of task that run in a predefined flow. Playbooks can include sub-playbooks, manual tasks, automated tasks that run scripts or commands, AI tasks, and Quick Actions. | | Issue | Issues identify the problems that you need to solve in your environment. Cortex AgentiX creates issues when problems occur in your environment that cross defined thresholds, or surpass your organization's accepted level of risk and threat tolerance. | | Case | A case is a workbench for resolving security problems in your environment. Each case groups related issues, highlights the impacted assets, and provides essential data in one place. Cases help you stay focused on threats and risks that have the most impact on the organization's security, help you reduce noise in your environment, and guide you to resolution using automation actions that reduce time and effort. | | Plan | A sequence of actions that run in parallel or sequentially to satisfy a user request. The agent dynamically chooses relevant actions to resolve the prompt. | | Conversation | A sequence of user requests that maintain context across interactions. | | Knowledge | In the **Knowledge Center**, you can ground AI agents in your organization's business-specific source of truth by managing internal knowledge sources. You can also leverage built-in Cortex (system) knowledge to provide agents with deep product expertise and technical platform logic. This enables agents to act as context-aware extensions of your team that understand both your internal workflows and the underlying platform. | | Request | A user request from the agent with an end goal, triggering a plan. | --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://cortex-docs.paloaltonetworks.com/cortex-agentix/learn-about-cortex-agentix/key-components-and-concepts.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.