> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cases-and-issues/investigation-and-response/cortex-assistant/cortex-assistant-capabilities.md).

# Cortex Assistant capabilities

### Entity investigation

The Cortex Assistant conducts investigations on entities entered in the search bar. It can investigate a range of entities, including hosts, users, hashes, domains, IP addresses, and cases. To initiate an investigation, enter the entity name in the search bar or ask specific questions about the entity, such as "What are the events related to \<entity>?". You can then select from the relevant options displayed in the **Investigate** column, which includes a comprehensive set of Cortex XQL library queries for conducting investigations. A summary of the entity's details is displayed. For more details, click **Show me more**.

{% hint style="info" %}

### Note

In some cases, if the prompt does not include at least one recognizable entity such as an IP, hash, user, asset, domain, case, or XQL query, no response is returned.
{% endhint %}

### Respond

After entering an entity in the Cortex Assistant search bar, you have the option to take action by selecting one of the suggestions listed in the **Respond** column. These suggestions encompass a variety of actions, such as running playbooks and scripts, performing scans, and collecting support files.

{% hint style="info" %}

### Note

When you choose an option from the **Respond** column, Cortex Assistant will always prompt you to approve the action before executing.
{% endhint %}

### RBAC

Cortex Assistant uses Cortex’s role-based access control (RBAC) to control the type of access and actions a user can perform in Cortex Cloud. Suggestions and responses offered by Cortex Assistant will be customized according to that specific user’s RBAC access. A user with Admin rights can manage user roles that are assigned to Cortex Cloud users or user groups in Cortex Cloud by selecting **Settings** → **Configurations** → **Access Management**.

For more information on user roles and groups, see [Manage user roles and access management](/cortex-cloud-posture-management/onboard-and-configure/post-deployment-steps/manage-user-roles-and-access-management.md).

### Navigation mode

Use Cortex Assistant to navigate in Cortex Cloud. You can search in navigation mode by entering a forward slash “/” in the search bar, followed by your search string. For example, typing `/issues` searches for all pages that include the term "issues" and allows you to navigate to them directly.

Additionally, you can enter multiple search terms, and Cortex Assistant will search for pages that include either of the terms (as if there were a logical OR between the words).


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cases-and-issues/investigation-and-response/cortex-assistant/cortex-assistant-capabilities.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.