Agentic Assistant components and concepts - Learn about the key components and concepts, such as agents and actions in the Cortex Agentic Assistant - Administrator Guide - Cortex XSIAM - Cortex - Security Operations

Actions

Actions wrap diverse capabilities (such as playbooks, scripts, and commands) to make them accessible and executable by an agent. You can use out-of-the-box system actions or register new actions.

Agent

An agent is a virtual persona that creates and executes domain-specific plans, at your request, to assist in your day-to-day SOC operations. An agent has roles and permissions that provide guardrails. Each agent is assigned a collection of actions that it can use as part of plans.

The agent chooses the most relevant actions to fulfill a user's request. Agents process user requests, create plans, and orchestrate actions based on their goals and permissions (RBAC and SBAC).

You can use the following types of agents:

Some agents provide relevant chat conversation starters under the chat prompt. For examples of conversation starters, see Agentic Assistant use cases.

Plan

A sequence of actions that run in parallel or sequentially to satisfy a user request. The agent dynamically chooses relevant actions to resolve the prompt.

Conversation

A sequence of user requests that maintains context across interactions.

Request

A user request from the agent with an end goal, triggering a plan.