> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/detect-investigate-and-respond-to-threats/agentic-assistant-chat/streamline-troubleshooting-and-support-with-the-help-center-agent/help-center-agent-actions.md).

# Help Center agent actions

The Help Center agent performs specific diagnostic and administrative actions to inspect your Cortex environment and ground its troubleshooting recommendations in live diagnostics. The following table describes the capabilities and limitations of each automated action the agent can perform.

| Action                                   | Description                                                         | Capabilities and Limitations                                                                     |
| ---------------------------------------- | ------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------ |
| Cortex - Check Allow Block Lists         | Checks whether a file hash is on the allow list or block list.      | Checks one SHA256 hash per call; no bulk lookup.                                                 |
| Cortex - Get Endpoint Policy             | Shows the security policy currently applied to an endpoint.         | Returns data for one endpoint per call.                                                          |
| Cortex - Get Issue Debug Log             | Retrieves the full debug log for an issue.                          | Returns data for one issue per call; log files can be large.                                     |
| Cortex - List BIOC Rules                 | Lists behavioral detection (BIOC) rules configured in the tenant.   | Paginated, 200 results per page by default. Full tenant coverage requires retrieving all pages.  |
| Cortex - List Datasets Management        | Lists the datasets configured in the tenant.                        | Returns all datasets by default; if configured otherwise, only the first 50 are returned.        |
| Cortex - List Endpoints                  | Searches and retrieves endpoint (agent) details.                    | 30 endpoints per page by default; "all results" request can return large volumes on big tenants. |
| Cortex - List Global Exceptions          | Shows the global exception profile applied across all endpoints.    | Returns a single profile; no filtering or pagination needed.                                     |
| Cortex - List Health Issues              | Lists active platform health issues affecting the tenant.           | Paginated, 100 results per page by default. Full coverage requires retrieving all pages.         |
| Cortex - List IOC BIOC Suppression Rules | Lists rules that suppress IOC and BIOC detections.                  | Paginated, 100 results per page by default. Full coverage requires retrieving all pages.         |
| Cortex - List IOC Rules                  | Lists indicator of compromise (IOC) rules configured in the tenant. | Paginated, 200 results per page. Full coverage requires retrieving all pages.                    |
| Cortex - List Issue Exception Rules      | Lists rules that suppress specific issues after detection.          | Paginated, 200 results per page. Full coverage requires retrieving all pages.                    |
| Cortex - List Issue Exclusion Rules      | Lists rules that block alerts before an issue is created.           | Paginated, 200 results per page. Full coverage requires retrieving all pages.                    |
| Cortex - List Assets                     | Retrieves asset information using flexible search filters.          | Paginated, 100 assets per page by default (max 5,000). Large tenants may require multiple calls. |
| Cortex - Diagnose Broker Collectors      | Diagnoses collector errors on a Broker VM.                          | Audit log results limited to 100 rows per query; VM name must match exactly.                     |
| Cortex - Create War Room Entry           | Adds a note to the War Room of one or more cases or issues.         | Limited to 20 cases/issues per call; requires explicit user approval before running.             |
| Cortex - Packs Version Check             | Checks installed Marketplace content packs for available updates.   | Reports all outdated packs in a single call. Read-only.                                          |
| Cortex - Update Content Packs            | Updates Marketplace content packs to their latest version.          | Requires explicit user approval; aborts if breaking changes are detected unless overridden.      |


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://cortex-docs.paloaltonetworks.com/cortex-xsiam/detect-investigate-and-respond-to-threats/agentic-assistant-chat/streamline-troubleshooting-and-support-with-the-help-center-agent/help-center-agent-actions.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.