Choose an Agentic Assistant agent - Choose a system or custom agent for your chat. - Administrator Guide - Cortex CLOUD

Case Investigation

Accelerate and simplify the analyst's workflow by converting complex data points, case context, and event relationships into clear, actionable insights. It understands the whole structure of a case, automatically highlights what matters most, and offers concise summaries that reduce noise and cognitive load. Beyond interpretation, it provides quick-access actions and guided steps that help analysts progress investigations with confidence and consistency. Its strength comes from its ability to reason across diverse evidence, stitch narrative context, and translate technical signals into meaningful next moves - enabling a smoother, more intuitive investigation experience end to end.

Email Investigation

Automates the full lifecycle of email-borne threat response, spanning mailbox search, forensic collection, analysis, containment, and incident closure across all major mail platforms and security layers.

Help Center

Provides answers to questions by referencing product documentation. If further assistance is needed, the agent assists you in opening a support case.

Network Security

Audits next-gen firewalls for vulnerabilities, expired certificates, outdated software, risky or unused rules, capacity limits, and other misconfigurations. It searches logs for threats and then automates or guides clean-ups and upgrades to keep the network secure.

Exposure Management

Helps understand, triage, and remediate vulnerabilities and misconfigurations across enterprise and cloud. Streamlines work for security analysts by helping to proactively prioritize risks, enrich identified exposures with ownership information, and take actions to reduce remediation times.

Cloud Posture

Helps understand, triage, and remediate misconfigurations, attack paths, and posture issues across cloud environments. Streamlines work for security analysts by proactively prioritizing risks, enriching identified exposures with ownership information, and automatically taking mitigating or remediating actions, such as blocking network access or updating protection policies, to reduce the organization's exposure footprint.

Application Security

Operates as an intelligent, autonomous co-pilot within the security program. It provides full-cycle management by continuously monitoring AppSec maturity and driving a prevention-first strategy. The agent performs key actions such as opening pull requests (PRs) to resolve issues, identifying true risks and critical weaknesses in code, and using that context to suggest and apply prevention guardrails that eliminate risky environments. Its core function is to guide the organization’s AppSec journey by proactively improving coverage and measuring maturity, ensuring that security is automated, not merely audited.