> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/automation/ai-prompts/create-a-prompt.md).
# Create a prompt
Creating a prompt turns custom requests into reusable AI prompts. Use prompts in playbooks or as Actions for Agents.
1. Navigate to **Investigation & Response** → **Automation** → **AI Prompts**.
2. Click **+ New Prompt**.
3. Add an identifying name for the prompt.
4. Save the prompt.
5. Enter the prompt settings.
Basic settings
Define the basic prompt parameters.
| Parameter | Description |
| ----------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Name | An identifying name for the prompt. |
| Description | A meaningful description of the prompt. If you plan to register it as an action, provide as much detail as possible. For example, the **Cortex - Blocklist Files** action description is: “Blocklists the specified SHA256 file hashes in Cortex by adding them to Cortex's blocklist. Skips any that already exist in Cortex's allowlist or blocklist. Optionally returns detailed results with counts of added and skipped hashes.” |
| Model | Tenants in selected regions can select an AI model. Available models include Flash, Thinking, and Pro. For supported models and regions, see [Frontier Models](/cortex-cloud-runtime-security/get-started/agentic-ai-in-cortex-cloud.md#frontier-models). |
| Tags | Predefined prompt identifiers. For example, use the **phishing** tag to organize phishing prompts. |
Advanced settings
Define settings that optimize the prompt.
| Parameter | Description |
| ----------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Temperature | Temperature enables customizing for pinpoint accuracy or diverse outputs by controlling the randomness of AI responses. The value must be between 0 and 2. Lower values (0-0.3) produce more focused, deterministic responses. Higher values (0.7-2) produce more creative, varied responses. You can set the value by entering a number or by adjusting the number on a slider. |
| Max Output Tokens | Max Output Tokens ensure responses adhere to specific length constraints by setting the maximum number of tokens the AI model can generate in response. Default is 2500 tokens. You can set the value by entering a number or by adjusting the number on a slider. |
6. Enter the prompt in the **Prompt** pane.
* For help writing effective prompts, see [Write effective prompts](/cortex-xsiam/learn-about-cortex-xsiam/readme.md).
* The Prompt Helper also provides a list of prompt writing tips, including:
Be clear and specific
Tell the AI exactly what you need.
Imagine you're asking a new team member for help – the more precise you are, the better they can assist. The same goes for our AI!
* What to do: Instead of vague questions like "Tell me about malware," try to be very specific. Think about:
* The goal: What do you want to achieve? (for example, "Summarize," "Identify," "Explain," "Generate ideas")
* The topic: What is the subject? (for example, "Phishing emails," "Vulnerability reports," "Security policies")
* Any details: What specific information is important? (for example, "From last week's incidents," "For non-technical executives," "Highlighting critical threats")
* Examples:
* Bad prompt: "Tell me about that virus ${VirusName}."
* Good prompt: "Analyze the attached malware report from ${Path} and summarize the key indicators of compromise (IOCs) for our incident response team."
Provide context and background
Give the AI the full picture.
Our AI doesn't know everything about your specific situation. Giving it background information helps it understand the "why" behind your request.
* What to do: Include relevant details that help the AI understand the situation or your specific needs.
* Role: Tell the AI to act as a specific persona (for example, "Act as a security analyst," "You are a CISO," "As a technical writer"). This helps it tailor its language and focus.
* Audience: Who is the information for? (for example, "For a technical audience," "For a board meeting," "For a general user"). This influences the complexity and depth of the response.
* Key Information: What specific data points or previous steps are relevant? (for example, "Based on the recent network scan results," "Considering the new compliance regulations").
* Examples:
* Bad prompt: "Write a report."
* Good prompt:"You are a cybersecurity consultant. Write a brief executive summary report for our CEO detailing the top three critical vulnerabilities identified in our recent penetration test report from ${Path} and suggest immediate actions."
Ask for the desired format
Guide the AI's output structure.
If you have a specific way you want the information presented, tell the AI upfront. This saves you time on reformatting.
* What to do: Clearly state how you want the AI's response to be structured.
* Lists: "Provide a bulleted list of..." or "Give me 5 key points."
* Tables: "Create a table with columns for \[X], \[Y], and \[Z]."
* Summaries/reports: "Generate a concise summary," "Draft a formal report," or "Write a brief email."
* Length: "Keep it under 200 words," or "Provide a detailed analysis."
* Examples:
* Bad Prompt: "What are the latest threats?
* "Good Prompt: "List the top 5 emerging cyber threats relevant to financial services, with a brief explanation for each, presented as a bulleted list."
Few-shot prompting
Use few-shot prompting when you need the AI prompt task to learn a new pattern or format quickly without extensive fine-tuning, especially for tasks with limited data.
* What to do: Provide several examples of the desired input and output to guide the AI's response.
* Examples of good prompts:
"You are a SOC analyst that needs to enrich CVE ${CVEId} , use the following structure:"
Sample structures:
* CVE Description: Apache Struts 2.5.x before 2.5.14, 2.3.x before 2.3.34, and 2.x.x before 2.3.x.x.x.x allows remote attackers to execute arbitrary code via a crafted Content-Type header.
* CVSS:9.8 (Critical)Impact: Remote Code Execution (RCE), potential for complete system compromise, data theft, and denial of service. Affects web applications built with Apache Struts, widely used in enterprise environments.
* Risk Score: 10/10 - Extremely High. Exploitability is high due to public exploits and widespread usage of the affected software.
* CVE Description: Microsoft Windows MSHTML Remote Code Execution Vulnerability. This vulnerability exists in the way MSHTML engine handles specially crafted files. An attacker could host a specially crafted website or send a specially crafted document that, when opened, could allow remote code execution.
* CVSS:8.8 (High)Impact: Remote Code Execution (RCE), arbitrary code execution in the context of the current user. Affects all Windows versions. Could lead to system compromise and data exfiltration. Often exploited via phishing campaigns.
* Risk Score: 9/10 - Very High. Widespread target, often exploited through user interaction, making it a common attack vector.
7. Add relevant inputs.
Inputs can be set with either context path or specific value. You can choose whether the input is a variable using ${\}.
8. Add relevant outputs:
1. **Context path**: The issue field the task results are saved to. For example, **issue.AIseverity**. This enables tasks that follow to locate the correct context and use that context as input.
2. **Description** (Optional): Description of the output.
3. **Type** (Optional): **Unknown**, **String**, **Number**, **Date**, **Boolean.**
4. **Use Structured output** (Optional)\
You can choose to **Use Structured output t**o enforce a specific JSON structure by providing a custom JSON schema. This ensures the model's response matches your required format, allowing subsequent playbook tasks to successfully use the output. When you select **Use structured output** in the **Outputs** tab you are provided with a JSON template that you can edit or replace entirely. If your JSON includes an invalid type, an error message appears and provides a list of the correct types.
Schema rules
Available top-level keys:
* “type”
* “properties”
* “required”
* “additionalProperties”
The top-level “type” must be “object.”\
\
A nested “type” must be one of the following
* array
* boolean
* integer
* null
* number
* object
* string
9. (Optional) Click **Optimize** to improve the prompt using predefined system guidelines.
The suggested prompt replaces the existing one. You can undo the optimization if needed.
10. (Recommended) Click Test to validate your prompt.
11. In the Arguments section, provide values for any inputs your prompt requires. These inputs are used to simulate how the prompt will behave in a live playbook, or how the prompt as an Action for an Agent will run as part of an executed plan.
You can add input values manually.
12. Click Run.
The tests are executed in a Playground environment. Review the output generated by the AI to validate the prompt's behavior and ensure it produces the expected results. The output is typically a text summary or another structured format that you have defined.
13. (Optional) Click [](https://docs-cortex.paloaltonetworks.com/viewer/attachment/5CAbsl8idaK8R43ZLhoTOw/thsZ_aCJgLfIxEAgkOeaiQ-5CAbsl8idaK8R43ZLhoTOw) and select Register new Action to register the prompt as an Action and make it available for Agents. For more information, see [Manage actions](https://docs-cortex.paloaltonetworks.com/access?ft:baseId=UUID-b1a99802-f0f3-ceae-f92b-0b5ab17ad4ee).
14. (Optional) Add the prompt as an AI prompt task to a playbook.
1. Edit or create a playbook.
2. In the playbook editor, expand the Task Library and select AI Prompts.
The System tab contains system AI prompt tasks, and the Custom tab contains custom AI prompt tasks.
3. Select the relevant AI prompt task and drag it onto the playbook editor.
The Task Details pane opens with the prompt appearing in the Prompt field.
4. Click OK.
The prompt appears in the playbook editor.
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:
```
GET https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/automation/ai-prompts/create-a-prompt.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.