Manage agents

Manage Cortex Cloud agents that coordinate actions and automated security workflows.

Agents create and execute step-by-step plans dynamically, choosing relevant actions based on a user's request. Each agent has a model, a user context, a conversation context, and a set of actions that it can perform. Users engage with agents through conversations in the chat interface.

Agents can only use actions that have been assigned to them, and execution is limited by the user's permissions.

Permissions for the Agentic Assistant and the Agentic Assistant Hub can be found under CORTEX AGENTIC ASSISTANT in the role permissions when creating or edit a role. For more information, see Agentic Assistant role-based access control

There are two types of agents in the Cortex Agentic Assistant:

• Custom agents: Each user can create one or more agents that have the same or fewer permissions as the user, ensuring agents operate with the least necessary privileges required. These permissions automatically update if the user’s roles or permissions change. When users create custom agents, they can create a private agent only they can access, or a public agent all users can access.
• System agents: System agents come out-of-the-box and are not linked to a specific user; instead, they possess their own defined roles and permissions. A system agent may include actions that the user does not have permission to execute. All users have access to all system agents, but plan execution is limited by the permissions of the individual user.

  System agents can include actions that require additional content packs to be installed and configured. To view all actions assigned to a system agent, including actions not available due to missing content, click on the system agent in the Agentic Assistant Hub. There may be actions assigned to a system agent that are not relevant to your organization. For example, the Case Investigation agent includes the action ServiceNow - Create Ticket, but you would only install and configure the relevant content pack if you wanted to create tickets in ServiceNow.

  System agents include system actions that may be marked as sensitive and require manual approval to execute. You can change this setting for specific system actions from the the Actions tab of the Agentic Assistant Hub, by clicking in the action card and selecting Mark as sensitive or Mark as non-sensitive.

Agent management

You can edit, delete, disable, or enable custom agents by clicking the more options icon for the agent.

You can edit, enable, or disable system agents by clicking the more options for the agent. The edit option for system agents is limited to adding specific instructions for the agent such as tone, style, format, and priorities.

You can click on an Agent to view all actions assigned to the agent. There are three possible statuses for actions assigned to an agent:

• Enabled (green circle with a check mark): The action is enabled and available for the agent to use.
• Disabled (grey circle with an x): The action has been disabled and is not available for the agent to use.
• Unavailable content (grey circle with a horizontal line): The content the action is based on is not available. To use the action, the content item must be installed and configured.

  In some cases, an agent may include actions with content items that are not relevant for all licenses. If that occurs, the grey circle appears, but you are not able to install the related content.

Search, filter, and sort existing agents

You can use the dropdown filter to search all agents, custom agents, enabled agents, or disabled agents.

You can sort agents by most used, creation time, or update time.