Key components and concepts

Learn about the key components and concepts, such as agents and actions in Cortex AgentiX.

Cortex AgentiX uses the following components and concepts:

Name	Description
Actions	Actions wrap diverse capabilities (such as playbooks, scripts, and commands, and AI prompts) to make them accessible and executable by an agent. You can use out-of-the-box system actions or register new actions.
Agent	An agent is a virtual persona that creates and executes domain specific plans, at your request, to assist in your day-to-day SOC operations. An agent has roles and permissions that provide guardrails. Each agent is assigned a collection of actions that it can use as part of plans. The agent chooses the most relevant actions to fulfill a user's request. Agents process user requests, create plans, and orchestrate actions based on their goals and permissions (RBAC and SBAC). You can use the following types of agents: System agents that are provided by Cortex AgentiX for specific use cases. Custom agents that the user has created. Some agents provide relevant chat conversation starters under the chat prompt. For examples of conversation starters, see Cortex AgentiX use cases. Note Agents are bound by the same rules and robust permissions as a human user. In addition, you can mark actions that make real-world changes in production systems as sensitive, requiring a quick manual review and confirmation, ensuring peace of mind before critical system changes are made.
Automation Rules	Automation rules allow the system to automatically respond to events by defining trigger conditions and desired actions, such as playbooks and Quick Actions, to perform once the condition is met.
Quick Actions	Quick Actions are preset single commands that enable you to automate basic tasks such as creating tickets in third-party systems, sending Slack messages, and changing issue severity.
Playbook	Playbooks are a series of task that run in a predefined flow. Playbooks can include sub-playbooks, manual tasks, automated tasks that run scripts or commands, AI tasks, and Quick Actions.
Issue	Issues identify the problems that you need to solve in your environment. Cortex AgentiX creates issues when problems occur in your environment that cross defined thresholds, or surpass your organization's accepted level of risk and threat tolerance.
Case	A case is a workbench for resolving security problems in your environment. Each case groups related issues, highlights the impacted assets, and provides essential data in one place. Cases help you stay focused on threats and risks that have the most impact on the organization's security, help you reduce noise in your environment, and guide you to resolution using automation actions that reduce time and effort.
Plan	A sequence of actions that run in parallel or sequentially to satisfy a user request. The agent dynamically chooses relevant actions to resolve the prompt.
Conversation	A sequence of user requests that maintain context across interactions.
Knowledge	In the Knowledge Center, you can ground AI agents in your organization's business-specific source of truth by managing internal knowledge sources. You can also leverage built-in Cortex (system) knowledge to provide agents with deep product expertise and technical platform logic. This enables agents to act as context-aware extensions of your team that understand both your internal workflows and the underlying platform.
Request	A user request from the agent with an end goal, triggering a plan.