Register actions - Register custom actions that can be used by agents. - Administrator Guide - Cortex XSIAM - Cortex XDR - Cortex - Security Operations

Cortex XDR 5.x Documentation

Product
Cortex XDR
License
XDR + Cloud
Creation date
2025-07-13
Last date published
2026-06-11
Category
Administrator Guide
Abstract

Register custom actions that can be used by agents.

You can register scripts, commands, and AI prompts as actions in the Agents Hub. After a script, command, or AI prompt is registered as an action, it can be added to one or more agents. The agents can then execute the action as part of plans.

Note

To register actions, ensure you have the correct permissions. For more information, see Agentic Assistant role-based access control.

When you register an action, you provide a description, goal, and, optionally, a few-shot examples. This information helps agents understand how the action should be used.

When registering or editing an action, you can choose which specific inputs and outputs are visible to the LLM. For example, a script might have two inputs and five outputs, but for this action, only one input and two outputs are required, and only those are included in the action. This helps to create more focused actions and reduces unnecessary complexity.

Important

A single content item can be registered as different actions, with each action using different inputs and outputs from the same script. Only register the same script, command, or AI prompt as a new action if it is required for your use case, as providing an agent with many actions with overlapping abilities can reduce the ability of the agent to choose the most appropriate action.

While you can create multiple actions from a single content item, each action must have a different name.

If you try to register a script, command, or AI prompt that is already registered, you are presented with a list of the actions already using it, and you can review and decide if any of them are relevant for your current use case. If not, you can register the script, command, or AI prompt again as a different action.

How to register an action
  1. Do one of the following:

    • Click the Agentic Assistant icon in the upper right hand corner and expand the side panel expandmenuicon.png to access the Agents Hub menu item. From the Actions tab of the Agents Hub, click Register new action.

    • Within the script creation or editing screen, click three-dots.png when viewing or editing a script and select Register as action.

    • Within the AI Prompts library, select a prompt and click the more options icon to Register as action.

  2. If you clicked Register as action from the Scripts or AI Prompts page, the name is prepopulated in the Content chosen field. If you clicked Register action from the Agents Hub, select script, command, or AI prompt for the Type of content and select the content you want to register.

  3. Enter an action Name, a short description of what the action does. Example: Extract email.

  4. Describe the Goal of the action.

  5. (Optional) By default, Mark action as sensitive to require user approval is selected, and the agent prompts the user to approve before executing the action. If you do not want the action marked as sensitive, clear the checkbox.

  6. (Optional) Provide Few-shot examples to help the agent understand the context and the appropriate situations to invoke a specific action.

  7. Click Next.

  8. Choose your Action Parameters:

    Note

    Mandatory arguments cannot be deselected.

    1. Choose which arguments and inputs to include in the action. If a content item contains descriptions of the inputs, the descriptions are prepopulated. If not, you can provide short descriptions. The descriptions help the agent understand the purpose of each input.

    2. (Optional) Enter a default value for each input. The default value is used when the user does not specify the input.

    3. Choose which script outputs to include in the action. If the content item contains descriptions of the outputs, the descriptions are prepopulated. If not, you can provide short descriptions. The descriptions help the agent understand the purpose of each output.

  9. Save changes.

Note

The execution of system or custom actions that are based on integration commands can be restricted using integration permissions.