Use the Automation Engineer agent to accelerate script development and deployment - Use the AI-powered Automation Engineer agent to create, modify, explore, and understand scripts. - Administrator Guide - Cortex XSIAM - Cortex

Use the Automation Engineer agent to accelerate script development and deployment - Use the AI-powered Automation Engineer agent to create, modify, explore, and understand scripts. - Administrator Guide - Cortex XSIAM - Cortex - Security Operations

Cortex XSIAM 3.x Documentation

Product

Cortex XSIAM

Creation date

2025-07-15

Last date published

2026-06-11

Note

The Automation Engineer agent is available with the Cortex Agentic Assistant, for users with script editing permissions. For more information, see Cortex Agentic Assistant and Agentic Assistant role-based access control.Cortex Agentic Assistant

How to use the Automation Engineer agent

From the Investigation & Response → Automation → Scripts page, either choose an existing script or create a new script.
For a new script:
1. Click + New Script, give the script a name, and click Save.
2. Click . The Agentic Assistant pane opens with the Automation Engineer agent automatically selected.
For an existing script:
1. In the Scripts Library, search for the script you want to use.
  Search tips
  Use the free text in the search box to find an existing script. From the search drop-down, you can:
  Perform a basic search by Basic (name and tag), Name, or Tag.
  Perform an advanced search for specific words In Script or Everywhere (including the script name and tags).
  You can search for an exact match of the script name by putting quotation marks around the search text. For example, searching for "AddKeyToList" returns the script with that name. You can search for more than one exact match by including the logical operator "or" in between your search texts in quotation marks. For example, searching for "AnalyzeTimestampIntervals" or "AddKeyToList" returns the two scripts with those names. Wildcards are not supported in free text search.
  You can sort the scripts in the library alphabetically, by modified date, by system, or custom, and you can filter for disabled or deprecated scripts.
  The Script Helper also provides a list of available alphabetically ordered commands and scripts.
2. Click Edit. The Agentic Assistant pane automatically opens with the Automation Engineer agent selected.
  If a script is installed from a content pack, by default, the script is locked, which means that it is not editable. To edit a system script, you first need to duplicate it.
If you are in the middle of a chat with a different agent, you are prompted to start a new chat with the Automation Engineer agent.
If you start a chat with one script and switch to another script, you are prompted to start a new chat.
In the Agentic Assistant pane, enter a natural language prompt describing what you need the agent to do, including:
- Explain what the script does.
- Fix code errors: If there are errors in the script code, you can ask the Automation Engineer agent to suggest a correction.
- Add documentation notes to the script: Ask to include explanations and inline comments.
- Add arguments to the script: Define the inputs your script should accept. Each argument should include a name, type, whether it is required, and optionally a default value.
  Examples:
  - days — number, optional, default: 3
  - email — string, required, email="soc@company.com
- Add outputs to the script: Describe what the script should return to the context, for example, recentIncidentsSummary — string, a human-readable summary of incidents.
- Include debug logging: Request to include contextual log messages in the script.
- Include error handling: Ask to include try/except blocks with informative error logs.
Tip
- Use detailed prompts, for example, Get failed logins from last 24 hours and return as a table.
- Clearly define argument names, types, and default values.
- Mention if you expect the output in a specific format, such as a table, JSON, or plain text.
Example 101.
The following are sample prompts:
```
Fetch all open incidents from the last 3 days. 
Generate a summary table with ID, name, and severity. 
Email the summary to the given address.

Arguments:
- days (number, default: 3)
- email (string, required)

Output:
- incidentsSummary (string): a human-readable table of incident details
```
```
Explain what this script does
```
```
How do I use the SDK to execute a search command?
```
```
I got this error: <KeyError>: <userId>. Fix it.
```
Click or Enter to submit the prompt.
The Agentic Assistant then displays:
- The plan describing the steps the Automation Engineer agent took.
- A script preview card that includes the following details:
  - The script name.
  - The script revision number (#).
  - Script metadata: The number of lines, arguments, and outputs.
  - An expand icon that shows the new script code with the option to Use this revision.
  - that includes Use this revision or Copy code.
The first line of the generated script indicates it was generated by AgentiX, with the date time of the latest update.
Use natural language in the prompt to modify the generated script as needed.
Example 102.
For the script generated from the sample prompt above, enter the following modification to add sorting:
```
Modify the sorting behavior so that all 1s (threats) come before all 0s (safe events). Keep the rest of the script structure the same.
1 / 1
```
Note
If you make manual edits in the script and don't save the changes and you then modify the script with the Automation Engineer agent, you are prompted to confirm overwriting the manual edits.
(Optional) Access an earlier script revision by clicking and then Use this revision on the script preview card of the revision you want to use.
Continue modifying and submitting prompts until the script works as intended.
For a new script, click Save Version. For an existing script that was edited, click Use this revision and then Save Version.

(Recommended) Validate your script.

Click Test.
In the Arguments section, provide values for any inputs your prompt requires. These inputs are used to simulate how the script will behave in a live playbook, or how the script registered as an Action and assigned to an Agent will run as part of an executed plan.
You can add input values manually.

Click Run.

The scripts are executed in the Playground. Review the output generated by the script to validate its behavior and ensure it produces the expected results. The output is typically a text summary or another structured format that you have defined.

Tip

If there is an error, you can copy the error message from the test result into the Agentic Assistant prompt and ask the Automation Engineer agent to correct the error.

In each run result, you can take the following actions:

Action	Description
Edit	Edit the entry, mark it as a note, preview it, or delete it.
Mark as note	Marks the entry as a note, which can help you understand why certain action was taken and assist future decisions. When marked as a note, it is highlighted, so you can easily find it in the War Room or the Issue Overview tab.
View artifact in new tab	Opens a new tab for the artifact.
Add tags	Add any relevant tags to use that help you find relevant information.