> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/upgrade-to-cortex-xdr-5/built-in-automations.md). # Built-in automations Cortex XDR 5 introduces next-level functionality to your security operations with embedded automation, a native capability that integrates industry-leading automation directly into your workflow. #### Transform Your Security Operations Embedded automation helps you streamline operations, accelerate triage, and boost productivity. Cortex XDR 5 automation includes: * **Pre-built and custom integrations:** Connect with your existing tools and services to create seamless, end-to-end workflows. * **Playbooks:** Automate complex, multi-step tasks with procedures that query, analyze, and take action quickly and efficiently to respond to security threats. Use our pre-built playbooks, or create your own. * **Automated quick actions:** Instantly respond to threats with single-click commands, providing rapid resolution for common issues. * **Automation rules:** Automatically trigger playbooks or quick actions based on specific criteria, ensuring immediate, consistent, and proactive responses to your most critical threats. * **Case investigation war rooms:** Collaborate and act on threats in real-time, with all the necessary tools and automation in one place. Previously-configured automation rules, established under Cortex XDR 4, will remain operational in their current state. However, the system prohibits both the editing of these legacy rules and the creation of any new rules using the legacy mechanism. Users are advised to transition to the new playbook-based automation mechanism for all future configurations. Once the desired automations have been successfully established, it is strongly recommended that the legacy automation rules be disabled. This action is encouraged to eliminate unnecessary redundancy within the system. Read more: [Automation in Cortex XDR](/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/automation.md) --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation by asking a question. Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters: ``` GET https://cortex-docs.paloaltonetworks.com/upgrade-to-cortex-xdr-5/built-in-automations.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.