Add AI Prompt tasks

Add AI Prompt tasks to automate AI-assisted workflows.

AI prompt tasks enable automated interaction with the Cortex Cloud built-in Large Language Model (LLM) as a single step in a playbook. AI prompt tasks contain a prompt with inputs and outputs that guide the LLM to perform specific actions and provide structured results. For example, use an AI prompt task to prompt the LLM to identify malware categories.

You can add the same AI prompt task more than once to a playbook. Each instance saves its settings locally.

From the Task Library, choose system AI prompt tasks with well-defined prompts for common use cases. Duplicate and edit these tasks, or create a custom AI prompt task for your needs.

Tip

For guidance on structuring your prompts, see Write effective prompts.

System AI prompt tasks in the Task Library

The following are examples of available system AI-based tasks.

Task name	Inputs	Outputs	Prompt
IssueSummaryAndRemediation	issue The issue details sent to the LLM for summarization.	llm.summary The LLM output summary.	See the expandable prompt below.
MalwareReportSummary	report_id The report ID sent to the LLM for summarization.	llm.summary The LLM output summary.	See the expandable prompt below.
VulnerabilityReportSummary	report_id The report ID sent to the LLM for summarization.	llm.summary The LLM output summary.	See the expandable prompt below.

IssueSummaryAndRemediation prompt

You are an experienced Security Operations Center (SOC) analyst with a deep understanding of security alert analysis and remediation. Your task is to provide detailed, actionable steps for remediating the security alert that has been provided. First, review the details of the security alert, including the Security Alert and the assessed Alert Severity level. Then, outline the key steps you would take to investigate and remediate the alert, referencing relevant security best practices, frameworks, or industry standards as appropriate. Once you have outlined the steps, provide a clear, concise, and easy-to-follow set of remediation instructions. Your answer should be tailored to the specific security alert and its severity level, and should include any relevant references to security guidelines or resources. Remember to be thorough and precise in your response, as the security analyst will be relying on your guidance to address the alert effectively.

General Scope and Instructions:

1. Only provide remediation steps for the alert.
2. Do not provide generic or unrelated recommendations outside of the alert scope.

Example:

Alert Summary

This alert is for a {ALERT_TYPE} on the {AFFECTED_SYSTEM} system, with a severity level of {ALERT_SEVERITY}.

Potential Impact

If this alert is not addressed, it could lead to significant consequences, such as data breaches, system vulnerabilities, or potential service disruptions.

Remediation Steps

1. [Step 1 remediation instruction]
2. [Step 2 remediation instruction]
3. [Step 3 remediation instruction]

Recap

Add a recap section.

Provide detailed remediation steps for the security alert ${alert} in a professional, well-structured format.

MalwareReportSummary prompt

You are a highly specialized Malware Analyst, with deep expertise in analyzing and interpreting sandbox execution reports. Your knowledge spans the entire malware execution lifecycle, from initial infection vector to command-and-control and post-exploitation behavior. You are also an expert in mapping malicious activity to the MITRE ATT&CK framework.

Your sole purpose is to analyze and summarize malware sandbox reports. You do not answer questions or generate responses unrelated to malware behavior analysis in the context of sandbox data. Focus exclusively on:

• Extracting detailed insights from sandbox execution logs and artifacts.
• Mapping observed behaviors to MITRE ATT&CK techniques.
• Identifying indicators of compromise (IOCs) and tactics, techniques, and procedures (TTPs).
• Only document IOCs with suspicious or malicious context. Do not list known or benign indicators.
• Describing malware behavior across the whole kill chain.
• Recommending remediation actions and next investigation steps.

Analyze the following malware sandbox execution report and provide a comprehensive, structured analysis:

• Summarize malware behavior across the entire attack kill chain: Initial Access → Execution → Persistence → Privilege Escalation → Defense Evasion → Credential Access → Discovery → Lateral Movement → Collection → Exfiltration → C2.
• Map relevant behaviors and activities to the MITRE ATT&CK framework where applicable.
• Highlight notable techniques, unusual behaviors, or key execution insights.
• List observed IOCs, including domains, IPs, hashes, and file paths.
• Provide remediation recommendations based on observed behavior.
• Suggest additional investigation steps or telemetry to collect if needed.

The final output should be detailed, well-structured, and actionable for incident response teams.

VulnerabilityReportSummary prompt

You are a vulnerability assessment analyst responsible for reviewing and analyzing vulnerability scan results provided in JSON format. Your objective is to thoroughly examine the scan data, deliver a comprehensive vulnerability analysis, and prioritize vulnerabilities that must be addressed immediately.

General Instructions:

1. Only provide recommendations related to the data in the report.
2. Do not provide generic recommendations that are not directly related to the data in the report.

Steps for Analysis:

Perform your assessment considering the following key criteria:

1. Criticality

   • Consider vulnerability severity ratings: Critical, High, Medium, Low, and Informational.
   • Evaluate CVSS base scores and severity definitions.
2. Exploitability

   • Evaluate how easily the vulnerability can be exploited remotely or locally.
   • Analyze exploitation complexity, including attack vector, required privileges, and user interaction.
   • Identify active exploits or proof-of-concept exploits in the wild.
3. Environmental Factors

   • Consider asset importance, such as business-critical servers, database hosts, and publicly exposed systems.
   • Assess affected system network accessibility, including internal and externally exposed systems.
   • Reflect on relevant regulatory compliance requirements, such as PCI-DSS, HIPAA, and GDPR.

Deliverable:

Provide your analysis in the following structured format:

1. Executive Summary

• Briefly summarize overall risk status based on scan results.

2. Detailed Vulnerability Analysis

For each vulnerability identified:

• Plugin Name & ID
• CVE Identifier, if applicable
• Affected Asset(s)
• Severity Rating & CVSS Base Score
• Exploitability Assessment:

  • Describe the likelihood and complexity of exploitation.
  • Reference known active exploits.
• Environmental Impact:

  • Explain potential business impact based on asset role and exposure.
  • Highlight compliance risks or regulatory impacts.

3. Prioritized Recommendations

• Provide a clearly ranked list of vulnerabilities to remediate, with high priority first.
• Justify prioritization using criticality, exploitability, and environmental factors.
• Suggest remediation actions for each vulnerability.

Important Considerations:

• Clearly justify each decision to ensure transparency.
• Maintain concise yet informative language for technical and managerial audiences.
• Emphasize vulnerabilities posing immediate and significant risk to the organization's security posture.

Please analyze the provided vulnerability scan results in detail. For each identified vulnerability:

• Describe the vulnerability clearly, including its type, affected service or component, and relevant technical details.
• Assess severity using industry-standard metrics, such as CVSS score or equivalent.
• Evaluate exploitability, including known public exploits and practical exploitation difficulty.
• Recommend remediation or mitigation steps, such as patching, configuration changes, or compensating controls.

Then, prioritize all vulnerabilities using:

1. Exploitability, including known exploits, attack complexity, and likelihood of exploitation.
2. Severity, including potential impact if exploited.
3. Exposure level, including internet-facing systems and critical internal services.

Provide a ranked list of vulnerabilities and explain each priority. Highlight quick wins where applicable: high-risk vulnerabilities that are easy to fix.

Add system AI prompt tasks

System AI prompt tasks include predefined prompts, inputs, and outputs. You cannot edit or remove them. Set inputs using issue context or specific values.

To change a system task, duplicate it from the AI Prompts page. Then edit the copy.

1

From the Task Library pane, select AI Prompts.

2

On the System tab, find the relevant built-in AI prompt task.

Use the search box to find a prompt with free text.

3

Drag the selected AI prompt task to the playbook editor.

The Task Details pane opens. Task Type is automatically set to AI Task.

4

Configure the AI prompt task parameters.

AI prompt task parameter tabs

Tab	Settings
Inputs	System AI prompt task input definitions, including name, description, and type, are fixed and non-editable. Includes: Prompt: The prompt passed to the LLM with the inputs. System prompts are not editable. Inputs use ${} placeholders that are filled with values. Expand the prompt for improved readability. Extracted Inputs: Set input values using a context path or a specific value. Mandatory inputs have an asterisk.
Outputs	AI prompt task outputs in system AI prompts can not be edited. If you need to edit the output options, duplicate the system AI prompt and edit the copy.
Advanced	Includes: Register as case timeline record: If enabled, the results of the task execution appear as a record in the case timeline. If enabled, you must enter a Record name. You have the option of adding an Effective time, Description, Tags, and marking the record as evidence and adding an evidence comment. NOTE: Only enter an Effective time if you want the same exact time recorded every time the playbook task executes. Extend context: Appends extracted action results to the context. For example, "newContextKey1=path1::newContextKey2=path2" returns [path1:'aaa',path2: 'bbb', newContexKey1: 'aaa',newContextKey2:'bbb']. Ignore outputs: When true, outputs are not stored in context, except extended outputs. Execution timeout (seconds): Sets the command execution timeout. Indicator Extraction mode: Choose when to extract indicators: Use system default: The default setting. None: Do not extract indicators. Inline: Extract before other playbook tasks. Out of band: Extract while other tasks run. Mark results as note Run without a worker Skip this branch if this script/playbook is unavailable Quiet Mode: Tasks do not display inputs or outputs, or extract indicators. Errors and warnings remain documented. Turn quiet mode on or off at the task or playbook level.
Details	Includes: Tag the result with: Add a tag to the task result. Use the tag to filter War Room entries. Task description (Markdown supported): Describe the task. You can include context data objects. For example, use a recipient email address in a communication task. The object value reflects the context whenever the task runs.
On Error	Includes: Number of retries: Number of retries after an error. Default: 0. Retry interval (seconds): Wait time between retries. Default: 30 seconds. The maximum is 800 seconds (13.3 minutes). Values above 800 are limited to 800.

1. Click OK.
2. Connect the system AI prompt task by dragging and dropping a wire.

   To perform actions based on task results, add a conditional task immediately afterwards.

Add custom AI prompt tasks

Create or edit a custom AI prompt task. You can also edit a duplicated system AI prompt.

1

From the Task Library pane, select AI Prompts.

2

Choose one of the following options:

• On the System tab, select Local AI Prompt to create a task.
• On the Custom tab, find an existing custom task. Select Local AI Prompt to create a task.

To use an existing custom task, drag it to the playbook editor.

Selecting Local AI Prompt creates a local task version in your playbook. Future Prompts Library updates do not sync to this task.

Choose Local AI Prompt when workflow-specific logic must remain unchanged. This prevents future improvements, such as prompt refinements, security patches, and model optimizations, from changing its behavior.

3

Configure the AI prompt task in the Task Details pane.

1. Set the AI prompt task name.

   The name must start with a letter. It cannot contain spaces or special characters.
2. Set the AI prompt task parameters.

Custom AI prompt task parameter tabs

Tab	Settings
Inputs	Expand this section to show: Prompt: Define a natural language prompt passed to the LLM with inputs. Mark input placeholders with square brackets, such as [input]. Extracted Inputs: Lists inputs defined in the prompt, in the same order. Set each input with a context path or specific value. You can set an input as a variable using ${<input name>}. Mandatory inputs have an asterisk. The Prompt Helper also provides prompt tips. NOTE: Tenants in selected regions can select an AI model. Available models include Flash, Thinking, and Pro. For supported models and regions, see Frontier Models.
Outputs	Includes: Context path: The issue field the task results are saved to. For example, issue.AIseverity. This enables tasks that follow to locate the correct context and use that context as input. Description (Optional): Description of the output. Type (Optional): Unknown, String, Number, Date, Boolean. Use Structured output (Optional) You can configure the AI prompt task output to enforce a specific JSON structure by providing a custom JSON schema. This ensures the model's response matches your required format, allowing subsequent playbook tasks to successfully use the output. When you select Use structured output in the Outputs tab you are provided with a JSON template that you can edit or replace entirely. Schema rules Available top-level keys: “type” “properties” “required” “additionalProperties” The top-level “type” must be “object.” A nested “type” must be one of the following array boolean integer null number object string If your JSON includes an invalid type, an error message appears and provides a list of the correct types.
Advanced	Includes: Register as case timeline record: If enabled, the results of the task execution appear as a record in the case timeline. If enabled, you must enter a Record name. You have the option of adding an Effective time, Description, Tags, and marking the record as evidence and adding an evidence comment. NOTE: Only enter an Effective time if you want the same exact time recorded every time the playbook task executes. Extend Issue context: Appends extracted action results to the context. For example, "newContextKey1=path1::newContextKey2=path2" returns [path1:'aaa',path2: 'bbb', newContexKey1: 'aaa',newContextKey2:'bbb']. Ignore outputs: When true, outputs are not stored in context, except extended outputs. Execution timeout (seconds): Sets the command execution timeout. Default: 10 seconds. Indicator Extraction mode: Choose when to extract indicators: Use system default: The default setting. None: Do not extract indicators. Inline: Extract before other playbook tasks. Out of band: Extract while other tasks run. Mark results as note Run without a worker Skip this branch if this script/playbook is unavailable Quiet Mode: Tasks do not display inputs or outputs, or extract indicators. Errors and warnings remain documented. Turn quiet mode on or off at the task or playbook level.
Details	Includes: Tag the result with: Add a tag to the task result. Use the tag to filter War Room entries. Task description (Markdown supported): Describe the task. You can include context data objects. For example, use a recipient email address in a communication task. The object value reflects the context whenever the task runs.
Timers	Includes: Timer.start: Trigger sending a message or survey to recipients. Change this trigger or add a trigger for Timer.stop or Timer.pause. Select the trigger timer field from the drop-down list. Add Trigger: Add other trigger timer fields from the drop-down list.
On Error	Includes: Number of retries: Number of retries after an error. Default: 0. Retry interval (seconds): Wait time between retries. Default: 30 seconds. The maximum is 800 seconds (13.3 minutes). Values above 800 are limited to 800.

Prompt Helper tips

Be clear and specific

Tell the AI exactly what you need. Treat it like a new team member. More precise requests produce better results.

What to do

Avoid vague requests such as “Tell me about malware.” Specify:

• Goal: For example, summarize, identify, explain, or generate ideas.
• Topic: For example, phishing emails, vulnerability reports, or security policies.
• Details: For example, last week's incidents, non-technical executives, or critical threats.

Examples

• Bad prompt: Tell me about that virus ${VirusName}.
• Good prompt: Analyze the attached malware report from ${Path} and summarize the key indicators of compromise (IOCs) for our incident response team.

Provide context and background

Give the AI the full picture. Background information explains the reason for your request.

What to do

Include relevant details, such as:

• Role: For example, “Act as a security analyst,” “You are a CISO,” or “As a technical writer.”
• Audience: For example, a technical audience, a board meeting, or a general user.
• Key information: For example, recent network scan results or new compliance regulations.

Examples

• Bad prompt: Write a report.
• Good prompt: You are a cybersecurity consultant. Write a brief executive summary report for our CEO detailing the top three critical vulnerabilities identified in our recent penetration test report from ${Path} and suggest immediate actions.

Ask for the desired format

State the required output structure. This reduces reformatting work.

What to do

• Lists: “Provide a bulleted list of...” or “Give me 5 key points.”
• Tables: “Create a table with columns for [X], [Y], and [Z].”
• Summaries or reports: “Generate a concise summary,” “Draft a formal report,” or “Write a brief email.”
• Length: “Keep it under 200 words,” or “Provide a detailed analysis.”

Examples

• Bad prompt: What are the latest threats?
• Good prompt: List the top 5 emerging cyber threats relevant to financial services, with a brief explanation for each, presented as a bulleted list.

Use few-shot prompting

Use few-shot prompting to teach a pattern or format without extensive fine-tuning. It is useful for tasks with limited data.

What to do

Provide several examples of the required input and output.

Example prompt

You are a SOC analyst that needs to enrich CVE ${CVEId}, use the following structure:

Sample structures

• CVE Description: Apache Struts 2.5.x before 2.5.14, 2.3.x before 2.3.34, and 2.x.x before 2.3.x.x.x.x allows remote attackers to execute arbitrary code via a crafted Content-Type header.
• CVSS: 9.8 (Critical). Impact: Remote Code Execution (RCE), potential for complete system compromise, data theft, and denial of service. Affects web applications built with Apache Struts, widely used in enterprise environments.
• Risk Score: 10/10 — Extremely High. Exploitability is high due to public exploits and widespread usage of the affected software.
• CVE Description: Microsoft Windows MSHTML Remote Code Execution Vulnerability. This vulnerability exists in the way the MSHTML engine handles specially crafted files. An attacker could host a specially crafted website or send a specially crafted document that, when opened, could allow remote code execution.
• CVSS: 8.8 (High). Impact: Remote Code Execution (RCE), arbitrary code execution in the current user context. Affects all Windows versions. It could lead to system compromise and data exfiltration. Phishing campaigns often exploit it.
• Risk Score: 9/10 — Very High. This is a widespread target. User interaction makes it a common attack vector.

1. Click Save.

   The AI prompt task appears in the playbook editor.
2. Connect the task by dragging and dropping a wire.

   To perform actions based on task results, add a conditional task immediately afterwards.
3. Click Save Playbook.

AI prompt task error handling

Configure error handling, including a return value when an AI prompt task fails. Failures can occur when the LLM times out, returns invalid output, exceeds a threshold, or is disabled.

The War Room logs the failure reason.

If an AI prompt task returns 504 Error with status DEADLINE_EXCEEDED, it likely requires more processing time than the default allows.

Open the AI task's Task Details pane. Select Advanced, then increase Execution timeout (seconds) for the prompt complexity and expected response time. Complex tasks, such as a complete vulnerability report, may require increasing the default from 10 seconds to 120 seconds or more.