> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/data-security-documentation/agentic-ai-and-cortex-agentic-assistant/agentic-ai.md). # About Agentic AI & the Cortex Agentic Assistant Cortex Data Security integrates advanced artificial intelligence to streamline security operations. Through the Cortex Agentic Assistant, the platform provides a unified interface for interacting with both system-provided and custom AI agents capable of creating and executing multi-step plans. These agents leverage specific capabilities to perform actions across your infrastructure, facilitating deep case investigations and proactive threat hunting while allowing for the creation of tailored automation. ## Key AI Capabilities * **Agents Hub**: A centralized hub for managing agents and actions. System agents can be enabled and disabled, and you can create custom agents tailored to your organizational needs, including the ability to execute custom scripts. * **Automation Engineer Agent**: Provides a natural language interface to draft, refine, and deploy automation scripts. * **MCP Integration**: Supports the configuration of integrations that communicate with external MCP servers, enabling agents to access third-party tools and data sources via a standardized protocol. * **Embedded AI Prompts**: Facilitates the inclusion of generative AI tasks within playbooks. These prompts function as standalone workflow steps to analyze data or generate content without requiring a dedicated agent. * **AI-Generated Case Summaries**: Automatically generate technical overviews of security incidents. These summaries consolidate complex telemetry and impact data into high-level reports to accelerate initial triage and stakeholder reporting. ### Cortex Agentic Assistant Cortex Agentic Assistant is the autonomous brain of Cortex Data Security. It uses AI agents that can plan and investigate complex threats. You interact with agents using natural language prompts. ### Enable Cortex Agentic Assistant 1. Go to `Settings > Configurations > General > Server Settings > Agentic Assistant`. 2. Enable **Agentic Assistant**. {% hint style="info" %} * Cortex Data Security provides **Cortex Assistant** by default. * It focuses on entity investigation and recommended next steps. * Enabling Agentic Assistant replaces that interface. * See [Investigation](/data-security-documentation/issue-management/investigation-and-response.md) for Cortex Assistant details. {% endhint %} ### Supported regions Cortex Agentic Assistant is available for tenants in these regions: * Australia (AU) * Canada (CA) * France (FA) * Germany (DE) * India (IN) * Japan (JP) * Netherlands (EU) * Singapore (SG) * South Korea (KR) * United Kingdom (UK) * United States (US) ### How it works Cortex Agentic Assistant is built from agents and actions. Agents pick actions to achieve your goal. Key concepts: * **Agent**: An AI persona with a specific mission. * **Action**: A capability an agent can execute. * Actions can wrap playbooks, scripts, commands, or AI prompts. * **Plan**: A multi-step sequence an agent builds and runs. Execution guardrails: * Agents run within your tenant permissions. * Sensitive actions require manual approval. * Agent actions are logged for auditability. ### System agents {% hint style="success" %} * Use the **Help Center Agent** to find docs fast. * Ask: “How do I create a dashboard?”. * Ask: “Where do I review data retention policies?”. {% endhint %} Use the **Cortex Agentic Assistant** dashboard to track adoption. Review agent plans, user prompts, and open cases. ### Use cases and example prompts Conversation starters help analysts move faster. They appear under the chat input. Common starters: * What are the top issues I should prioritize today? * Show me all issues with an overdue SLA * Which automations are waiting for my input? More examples: * Read this Unit42 blog and extract all CVEs. * For critical CVEs, check exposure and isolate vulnerable assets. * List recent security issues with high severity and hostname containing `server`. * Summarize security issues from the last 24 hours. * Show recent SSO-related issues. * Investigate this phishing issue and block malicious indicators. * How do I make a loop inside a playbook? * What is the riskiest unresolved issue affecting critical infrastructure? For investigation workflows, see [Investigation](/data-security-documentation/issue-management/investigation-and-response.md). ### Security and governance Agentic Assistant follows responsible AI principles. It is designed to be transparent and controllable. #### Access control and permissions Admins control access using role-based access control (RBAC). RBAC gates both chat access and Agents Hub administration. Agents are permission-bound: * An agent can only run actions assigned to it. * Execution is limited by the invoking user’s permissions. * Missing integrations make related actions fail. #### Data security and control Data is hosted and encrypted in a dedicated GCP project. Customer data is isolated using IAM permissions. Sensitive actions require explicit user approval. They are never executed automatically. * Prompts and outputs are processed only for the current response. * They are not collected for model training. * They are not shared with third parties. Prompts and responses stay within the tenant region boundary. #### Transparency and auditing * Expand **Plan** to review the agent’s interpretation and steps. * Review the actions used during execution. * Review generated artifacts, including JSON outputs. All executed actions are saved in an audit dataset. You can trace who invoked what and when. --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://cortex-docs.paloaltonetworks.com/data-security-documentation/agentic-ai-and-cortex-agentic-assistant/agentic-ai.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.