> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cases-and-issues/investigation-and-response/automation/playbooks/accelerate-playbook-development-using-the-automation-engineer-agent-preview/automation-engineer-prompt-examples.md). # Automation Engineer prompt examples The following table provides some use case scenarios and the corresponding prompts used to generate automated response playbooks within Cortex Cloud. | Use case scenario | Prompt | | ----------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Triage IP and notify IT of malware | "Create a playbook that triggers on a new network alert containing an IP address. First, run standard IP enrichment and threat intelligence lookups to triage the IP and check for associated malware. Next, add a conditional task to evaluate if the IP is marked as malicious. If it is malicious, use the mail integration to send an email to containing the IP address, the alert details, and the associated malware context. If it is benign, close the incident." | | Verify TOR connection and retrieve Machine ID | "Create a playbook that triggers on a network alert indicating potential TOR usage. First, extract the source IP, destination IP, and user details from the alert. Verify the connection by checking if the destination IP is a known TOR exit node or if the application signature is explicitly flagged as TOR. Next, add a conditional task: if TOR usage is confirmed, retrieve the endpoint's Machine ID or hostname associated with the user. Finally, use the mail integration to send an email to IT containing the username, the confirmed TOR connection details, and the Machine ID. If it is not TOR, close the incident." | | Evaluate and block malicious users or domains | "Create a playbook that triggers on an alert containing a username and a domain. First, run standard enrichment: check the domain's reputation using threat intelligence, and retrieve the user's risk profile or Active Directory status. Next, add a conditional task to evaluate if blocking is required based on whether the domain is flagged as malicious or the user risk score is critically high. If a block is required, use the mail integration to send an email to IT containing the user details, the suspicious domain, the threat context, and explicit instructions on whether to block the domain, suspend the user, or both. If the activity is benign, close the incident." | | Advanced Parallel Triage: Suspicious User + Domain Activity | "Create a security-response playbook named 'Suspicious User + Domain Activity — Automated Triage'. 1. Trigger: Require 'username' and 'domain' inputs with initial validation. 2. Parallel Enrichment: Concurrently run Task A (Domain Reputation via !domain), Task B (AD Lookup via !ad-get-user), and Task C (User Risk via identity integration). Each must have error handling to assign safe defaults. 3. Logic: Use a conditional task 'Is Blocking Required?' with three branches: YES (Domain score >=70/malicious OR User risk >=80/high/critical), NO (both clean), and REVIEW (ambiguous/defaults used). 4. Actions: For YES, send email to with labeled sections for User, Domain, Context, and Recommended Action (Block/Suspend/Both), then set severity to High. For NO, close as False Positive. For REVIEW, assign a manual task with a 4-hour SLA. All branches must converge to a single END node." | --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cases-and-issues/investigation-and-response/automation/playbooks/accelerate-playbook-development-using-the-automation-engineer-agent-preview/automation-engineer-prompt-examples.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.