Help Center agent actions

The Help Center agent performs specific diagnostic and administrative actions to inspect your Cortex environment and ground its troubleshooting recommendations in live diagnostics. The following table describes the capabilities and limitations of each automated action the agent can perform.

Action	Description	Capabilities and Limitations
Cortex - Check Allow Block Lists	Checks whether a file hash is on the allow list or block list.	Checks one SHA256 hash per call; no bulk lookup.
Cortex - Get Endpoint Policy	Shows the security policy currently applied to an endpoint.	Returns data for one endpoint per call.
Cortex - Get Issue Debug Log	Retrieves the full debug log for an issue.	Returns data for one issue per call; log files can be large.
Cortex - List BIOC Rules	Lists behavioral detection (BIOC) rules configured in the tenant.	Paginated, 200 results per page by default. Full tenant coverage requires retrieving all pages.
Cortex - List Datasets Management	Lists the datasets configured in the tenant.	Returns all datasets by default; if configured otherwise, only the first 50 are returned.
Cortex - List Endpoints	Searches and retrieves endpoint (agent) details.	30 endpoints per page by default; "all results" request can return large volumes on big tenants.
Cortex - List Global Exceptions	Shows the global exception profile applied across all endpoints.	Returns a single profile; no filtering or pagination needed.
Cortex - List Health Issues	Lists active platform health issues affecting the tenant.	Paginated, 100 results per page by default. Full coverage requires retrieving all pages.
Cortex - List IOC BIOC Suppression Rules	Lists rules that suppress IOC and BIOC detections.	Paginated, 100 results per page by default. Full coverage requires retrieving all pages.
Cortex - List IOC Rules	Lists indicator of compromise (IOC) rules configured in the tenant.	Paginated, 200 results per page. Full coverage requires retrieving all pages.
Cortex - List Issue Exception Rules	Lists rules that suppress specific issues after detection.	Paginated, 200 results per page. Full coverage requires retrieving all pages.
Cortex - List Issue Exclusion Rules	Lists rules that block alerts before an issue is created.	Paginated, 200 results per page. Full coverage requires retrieving all pages.
Cortex - List Assets	Retrieves asset information using flexible search filters.	Paginated, 100 assets per page by default (max 5,000). Large tenants may require multiple calls.
Cortex - Diagnose Broker Collectors	Diagnoses collector errors on a Broker VM.	Audit log results limited to 100 rows per query; VM name must match exactly.
Cortex - Create War Room Entry	Adds a note to the War Room of one or more cases or issues.	Limited to 20 cases/issues per call; requires explicit user approval before running.
Cortex - Packs Version Check	Checks installed Marketplace content packs for available updates.	Reports all outdated packs in a single call. Read-only.
Cortex - Update Content Packs	Updates Marketplace content packs to their latest version.	Requires explicit user approval; aborts if breaking changes are detected unless overridden.