Use natural language to query and visualize your data - Prompt Cortex Agentic Assistant agents to create graphs and charts from its findings. - Administrator Guide - Cortex XSIAM - Cortex - Security Operations

Cortex XSIAM 3.x Documentation
Product
Cortex XSIAM
Creation date
2025-07-15
Last date published
2026-06-11
Category
Administrator Guide
Abstract

Prompt Cortex Agentic Assistant agents to create graphs and charts from its findings.

Use natural language prompts to request visual insights by instructing the Agentic Assistant to display its findings as charts or graphs. This makes it easy to visualize data for threat hunting, business intelligence, or investigations without writing XQL queries or manually creating data visualization.

When you request a visualization, the agent generates an XQL query, executes it, and then presents the results in a graph. Agentic Assistant supports all graph types supported by the Cortex Platform.

This feature is provided as a built-in system hidden action and does not appear in the Agents Hub. It is an enhancement of the built-in TextToXQL and Cortex - Run XQL Query actions. For more information, see Create and run XQL queries with Agentic Assistant chat.

Best practices for prompting

We recommend using clear specific language to request that the agent create these visualizations. Use terminology such as:

  • Create a pie chart showing the distribution of alert severities over the last 7 days.

  • Visualize the top 10 targeted assets by malware in a bar chart.

  • Generate a line chart tracking the number of failed login attempts per day for the past month.

Visualization capabilities

To help you get the most out of your generated grpahs and charts, the Agentic Assistant supports the following capabilities:

  • Visualization creation or editing: You can use natural language to instruct the agent to build a new query from scratch or to modify an existing one.

  • Data filtering: You can ask the agent to alter the visual representation of your data. The system supports filtering without risking any changes to or breaking the existing underlying XQL query.

  • Dashboard integration: Once the graph or chart is created, you can click three-dots-dark.png to save it to the Widget Library and then apply it to your dashboard from the Widget Library.

    Note

    Once the graph or chart is saved the Widget Library, the link to the chat artifact is severed, and the agent does not track subsequent changes made to the widget or the dashboard.