Configure the Cortex Agentic Assistant ↗

The Cortex XSIAM Agentic Assistant helps SOC teams investigate, triage, and respond through AI agents. Agents turn security operations requests into plans and execute approved actions within each user's permissions.

How the components work together

An agent is a specialized virtual persona for a security operations domain or workflow. It selects from its assigned actions to build and run an investigation or response plan.

Actions wrap capabilities such as Cortex XSIAM playbooks, scripts, AI prompts, and commands. Add only the actions each agent needs.

Knowledge gives AI agents business-specific context and Cortex XSIAM product expertise. Knowledge sources and MCP integrations can extend an agent's context and capabilities.

Role-based access control (RBAC) defines who can use Agentic Assistant chat, manage actions, and manage agents. Agents never exceed the permissions of the user running them.

Configure your agent workforce in Cortex XSIAM

  1. Review Agentic Assistant components and concepts before designing an agent.
  2. Use the Agentic Assistant Hub to register security automation actions, build AI agents, and assign actions.
  3. Add knowledge sources or MCP integrations when the AI agent needs more context or capabilities.
  4. Configure role-based access control before giving users access.