Provide the agent with detailed customized instructions. You can include a wide range of directives, from describing the agent's role and preferred terminology to step-by-step processes and structure of the output.
Role: What the agent is supposed to be or act as. Defines its identity and primary function.
Example A: SOC tier 1 analyst. As a tier 1 analyst you are responsible for triaging alerts and concluding if an alert is a true or false positive.
Example B: Incident response analyst. As an incident response analyst you are responsible for investigating and conducting forensics of relevant artifacts related to an incident. You provide conclusions about the incident and TTP's used by the threat actor.
Instructions: The specific rules and behavioral guidelines that tell the agent how to operate and respond.
Example: Follow the NIST framework, provide clear and concise recommendations, use critical thinking when conducting analysis.
Structure: How the agent should format and organize its responses.
Examples of possible formats: JSON, Markdown, Array, enum.
NOTE
If you clear the checkbox for a role, all actions associated with that role are also cleared. The exception is if another role is also selected, which is associated with the same actions.
If you clear the checkbox for an action, all roles associated with that action are cleared. For example, if you select the Investigator role, and Send Mail and Tavily Extract are both actions associated with that role, clearing the check box for Investigator also clears the check box for Send Mail and Tavily Extract. If you then reselect the Send Mail action, the Investigator role is not automatically selected.
Not all actions are associated with a role.
For an agent to be able to run XQL queries, you must add the Cortex - Run XQL Query action. This action is included by default for all system agents.