> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/automation/playbooks/accelerate-playbook-development-using-the-automation-engineer-agent-preview.md). # Accelerate playbook development using the Automation Engineer agent (preview) You can now use the Automation Engineer agent in the Cortex Agentic Assistant to develop playbooks through an interactive, natural language experience (preview). {% hint style="info" %} ### Note This feature is not enabled by default. To request access, contact Cortex Product Management. {% endhint %} Automation Engineer capabilities include: * Creating playbooks\ Generate a functional playbook for your use case from a natural language prompt.\ **Example**:\ “Create a playbook that is triggered by a new network alert containing an IP address. First, run standard IP enrichment and threat intelligence lookups to triage the IP and check for associated malware. Next, add a conditional task to evaluate if the IP is marked as malicious. If it is malicious, use the mail integration to send an email to containing the IP address, the alert details, and the associated malware context. If it is benign, close the incident.” * Updating playbooks\ Modify existing tasks, logic, or integrations using follow-up prompts.\ **Example**: * “Add error handling to this flow” * “In the 'Is Malicious' condition, change the target email address to .” * Querying and explaining existing playbooks\ Ask the agent questions to understand complex playbook logic, troubleshoot specific tasks, or get AgentiX SDK guidance. You can ask questions about the logic of locked system playbooks (from content packs), though you must duplicate them to apply AI-generated modifications.\ **Example**: * "Explain the logic behind the conditional branch in this playbook?" * "How do I use the AgentiX SDK to add a custom header to the outgoing email task in this workflow?" {% hint style="info" %} ### Note The Automation Engineer agent is available with the Cortex Agentic Assistant, for users with playbook view/edit permissions and Interact with agent enabled. For more information, see [Agentic Assistant role-based access control](https://docs-cortex.paloaltonetworks.com/r/5CAbsl8idaK8R43ZLhoTOw/3aMi~83o6bmkAXF1dCgFMw). {% endhint %} **How to use the Automation Engineer agent** 1. Navigate to **Investigation & Response** → **Automation** → **Playbooks**. 2. Create a new playbook or open an existing one to enter the Playbook Editor. 3. Click the Agentic Assistant icon ![](/files/KlPMU7bP8UD260xxXgYV). The **Agentic Assistant** pane opens with the Automation Engineer agent automatically selected. 4. In the chat interface, enter a natural language prompt describing the automation you want to build or the change you want to make.\ The agent automatically uses the active playbook as context. Any request to create, modify, or query details applies specifically to that playbook.\ Examples:\ \- "Build a playbook that is triggered by a phishing alert, extracts the sender's domain, and checks its reputation using VirusTotal. If malicious, block the domain in Okta and notify the security team via Slack."\ \- “Create a playbook that is triggered by a new network alert containing an IP address. First, run standard IP enrichment and threat intelligence lookups to triage the IP and check for associated malware. Next, add a conditional task to evaluate if the IP is marked as malicious. If it is malicious, use the mail integration to send an email to containing the IP address, the alert details, and the associated malware context. If it is benign, close the incident.” 5. Click the submit arrow or press Enter to submit the prompt.\ The Agentic Assistant then displays: * The plan describing the steps the Automation Engineer agent took, including analyzing the request, retrieving relevant integrations, and generating the playbook logic. * A playbook preview card that includes the following details: * The playbook name. * The playbook revision number (#). * Playbook metadata: The number of tasks, inputs, and outputs. * An expand icon to view the updated playbook structure visually, with the option to click Use this revision. * The options menu **⋮** that includes **Use this revision**. 6. Modify the revision (optional).\ You can refine the suggested workflow by providing additional instructions. For example, "Add a 10-minute delay before the Slack notification".\ If the agent cannot find a specific command or script for a task, it creates a placeholder task in the editor for you to complete manually. 7. Click **Use this revision** to push the AI-generated logic to the Playbook Editor.\ Revisions can only be applied while in Edit Mode. If you have unsaved manual changes, the system prompts you to confirm before overwriting them. ### Track AI-assisted development To help maintain visibility into which automations were created or modified by AI: * Any playbook generated or significantly modified by the agent is automatically assigned the **AI Assisted** tag. * The Agentic Assistant maintains a history of your conversation and revisions, allowing you to compare versions or revert to an earlier state. ### Best practices You don't need a perfect prompt on the first try. Use iterative feedback to fine-tune your playbook. **Example**: * "Add error handling for the VirusTotal task." * "Change the notification channel from Slack to Microsoft Teams." * "Ensure the playbook only triggers if the severity is High." --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/automation/playbooks/accelerate-playbook-development-using-the-automation-engineer-agent-preview.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.