Create a prompt

Create or edit prompts, configure settings, and use them in agents or playbooks.

Creating a prompt turns custom requests into reusable AI prompts. Use prompts in playbooks or as Actions for Agents.

1. Navigate to Investigation & Response → Automation → AI Prompts.
2. Click + New Prompt.
3. Add an identifying name for the prompt.
4. Save the prompt.
5. Enter the prompt settings.

Basic settings

Define the basic prompt parameters.

Parameter	Description
Name	An identifying name for the prompt.
Description	A meaningful description of the prompt. If you plan to register it as an action, provide as much detail as possible. For example, the Cortex - Blocklist Files action description is: “Blocklists the specified SHA256 file hashes in Cortex by adding them to Cortex's blocklist. Skips any that already exist in Cortex's allowlist or blocklist. Optionally returns detailed results with counts of added and skipped hashes.”
Model	Tenants in selected regions can select an AI model. Available models include Flash, Thinking, and Pro. For supported models and regions, see Frontier Models.
Tags	Predefined prompt identifiers. For example, use the phishing tag to organize phishing prompts.

Advanced settings

Define settings that optimize the prompt.

Parameter	Description
Temperature	Temperature enables customizing for pinpoint accuracy or diverse outputs by controlling the randomness of AI responses. The value must be between 0 and 2. Lower values (0-0.3) produce more focused, deterministic responses. Higher values (0.7-2) produce more creative, varied responses. You can set the value by entering a number or by adjusting the number on a slider.
Max Output Tokens	Max Output Tokens ensure responses adhere to specific length constraints by setting the maximum number of tokens the AI model can generate in response. Default is 2500 tokens. You can set the value by entering a number or by adjusting the number on a slider.

1. Enter the prompt in the Prompt pane.

• For help writing effective prompts, see Write effective prompts.
• The Prompt Helper also provides a list of prompt writing tips, including:

Be clear and specific

Tell the AI exactly what you need.

Imagine you're asking a new team member for help – the more precise you are, the better they can assist. The same goes for our AI!

• What to do: Instead of vague questions like "Tell me about malware," try to be very specific. Think about:

  • The goal: What do you want to achieve? (for example, "Summarize," "Identify," "Explain," "Generate ideas")
  • The topic: What is the subject? (for example, "Phishing emails," "Vulnerability reports," "Security policies")
  • Any details: What specific information is important? (for example, "From last week's incidents," "For non-technical executives," "Highlighting critical threats")
• Examples:

  • Bad prompt: "Tell me about that virus ${VirusName}."
  • Good prompt: "Analyze the attached malware report from ${Path} and summarize the key indicators of compromise (IOCs) for our incident response team."

Provide context and background

Give the AI the full picture.

Our AI doesn't know everything about your specific situation. Giving it background information helps it understand the "why" behind your request.

• What to do: Include relevant details that help the AI understand the situation or your specific needs.

  • Role: Tell the AI to act as a specific persona (for example, "Act as a security analyst," "You are a CISO," "As a technical writer"). This helps it tailor its language and focus.
  • Audience: Who is the information for? (for example, "For a technical audience," "For a board meeting," "For a general user"). This influences the complexity and depth of the response.
  • Key Information: What specific data points or previous steps are relevant? (for example, "Based on the recent network scan results," "Considering the new compliance regulations").
• Examples:

  • Bad prompt: "Write a report."
  • Good prompt:"You are a cybersecurity consultant. Write a brief executive summary report for our CEO detailing the top three critical vulnerabilities identified in our recent penetration test report from ${Path} and suggest immediate actions."

Ask for the desired format

Guide the AI's output structure.

If you have a specific way you want the information presented, tell the AI upfront. This saves you time on reformatting.

• What to do: Clearly state how you want the AI's response to be structured.

  • Lists: "Provide a bulleted list of..." or "Give me 5 key points."
  • Tables: "Create a table with columns for [X], [Y], and [Z]."
  • Summaries/reports: "Generate a concise summary," "Draft a formal report," or "Write a brief email."
  • Length: "Keep it under 200 words," or "Provide a detailed analysis."
• Examples:

  • Bad Prompt: "What are the latest threats?
  • "Good Prompt: "List the top 5 emerging cyber threats relevant to financial services, with a brief explanation for each, presented as a bulleted list."

Few-shot prompting

Use few-shot prompting when you need the AI prompt task to learn a new pattern or format quickly without extensive fine-tuning, especially for tasks with limited data.

• What to do: Provide several examples of the desired input and output to guide the AI's response.
• Examples of good prompts:

  "You are a SOC analyst that needs to enrich CVE ${CVEId} , use the following structure:"

  Sample structures:

  • CVE Description: Apache Struts 2.5.x before 2.5.14, 2.3.x before 2.3.34, and 2.x.x before 2.3.x.x.x.x allows remote attackers to execute arbitrary code via a crafted Content-Type header.
  • CVSS:9.8 (Critical)Impact: Remote Code Execution (RCE), potential for complete system compromise, data theft, and denial of service. Affects web applications built with Apache Struts, widely used in enterprise environments.
  • Risk Score: 10/10 - Extremely High. Exploitability is high due to public exploits and widespread usage of the affected software.
  • CVE Description: Microsoft Windows MSHTML Remote Code Execution Vulnerability. This vulnerability exists in the way MSHTML engine handles specially crafted files. An attacker could host a specially crafted website or send a specially crafted document that, when opened, could allow remote code execution.
  • CVSS:8.8 (High)Impact: Remote Code Execution (RCE), arbitrary code execution in the context of the current user. Affects all Windows versions. Could lead to system compromise and data exfiltration. Often exploited via phishing campaigns.
  • Risk Score: 9/10 - Very High. Widespread target, often exploited through user interaction, making it a common attack vector.

1. Add relevant inputs.

   Inputs can be set with either context path or specific value. You can choose whether the input is a variable using ${<input name>}.
2. Add relevant outputs:

   1. Context path: The issue field the task results are saved to. For example, issue.AIseverity. This enables tasks that follow to locate the correct context and use that context as input.
   2. Description (Optional): Description of the output.
   3. Type (Optional): Unknown, String, Number, Date, Boolean.
   4. Use Structured output (Optional) You can choose to Use Structured output to enforce a specific JSON structure by providing a custom JSON schema. This ensures the model's response matches your required format, allowing subsequent playbook tasks to successfully use the output. When you select Use structured output in the Outputs tab you are provided with a JSON template that you can edit or replace entirely. If your JSON includes an invalid type, an error message appears and provides a list of the correct types.

Schema rules

Available top-level keys:

• “type”
• “properties”
• “required”
• “additionalProperties”

The top-level “type” must be “object.” A nested “type” must be one of the following

• array
• boolean
• integer
• null
• number
• object
• string

1. (Optional) Click Optimize to improve the prompt using predefined system guidelines.

   The suggested prompt replaces the existing one. You can undo the optimization if needed.
2. (Recommended) Click Test to validate your prompt.
3. In the Arguments section, provide values for any inputs your prompt requires. These inputs are used to simulate how the prompt will behave in a live playbook, or how the prompt as an Action for an Agent will run as part of an executed plan.

   You can add input values manually.
4. Click Run.

   The tests are executed in a Playground environment. Review the output generated by the AI to validate the prompt's behavior and ensure it produces the expected results. The output is typically a text summary or another structured format that you have defined.
5. (Optional) Click and select Register new Action to register the prompt as an Action and make it available for Agents. For more information, see Manage actions.
6. (Optional) Add the prompt as an AI prompt task to a playbook.

   1. Edit or create a playbook.
   2. In the playbook editor, expand the Task Library and select AI Prompts.

      The System tab contains system AI prompt tasks, and the Custom tab contains custom AI prompt tasks.
   3. Select the relevant AI prompt task and drag it onto the playbook editor.

      The Task Details pane opens with the prompt appearing in the Prompt field.
   4. Click OK.

      The prompt appears in the playbook editor.