The Help Center agent performs specific diagnostic and administrative actions to inspect your Cortex environment and ground its troubleshooting recommendations in live diagnostics. The following table describes the capabilities and limitations of each automated action the agent can perform.
| Action | Description | Capabilities and Limitations |
| ---------------------------------------- | ------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------ |
| Cortex - Check Allow Block Lists | Checks whether a file hash is on the allow list or block list. | Checks one SHA256 hash per call; no bulk lookup. |
| Cortex - Get Endpoint Policy | Shows the security policy currently applied to an endpoint. | Returns data for one endpoint per call. |
| Cortex - Get Issue Debug Log | Retrieves the full debug log for an issue. | Returns data for one issue per call; log files can be large. |
| Cortex - List BIOC Rules | Lists behavioral detection (BIOC) rules configured in the tenant. | Paginated, 200 results per page by default. Full tenant coverage requires retrieving all pages. |
| Cortex - List Datasets Management | Lists the datasets configured in the tenant. | Returns all datasets by default; if configured otherwise, only the first 50 are returned. |
| Cortex - List Endpoints | Searches and retrieves endpoint (agent) details. | 30 endpoints per page by default; "all results" request can return large volumes on big tenants. |
| Cortex - List Global Exceptions | Shows the global exception profile applied across all endpoints. | Returns a single profile; no filtering or pagination needed. |
| Cortex - List Health Issues | Lists active platform health issues affecting the tenant. | Paginated, 100 results per page by default. Full coverage requires retrieving all pages. |
| Cortex - List IOC BIOC Suppression Rules | Lists rules that suppress IOC and BIOC detections. | Paginated, 100 results per page by default. Full coverage requires retrieving all pages. |
| Cortex - List IOC Rules | Lists indicator of compromise (IOC) rules configured in the tenant. | Paginated, 200 results per page. Full coverage requires retrieving all pages. |
| Cortex - List Issue Exception Rules | Lists rules that suppress specific issues after detection. | Paginated, 200 results per page. Full coverage requires retrieving all pages. |
| Cortex - List Issue Exclusion Rules | Lists rules that block alerts before an issue is created. | Paginated, 200 results per page. Full coverage requires retrieving all pages. |
| Cortex - List Assets | Retrieves asset information using flexible search filters. | Paginated, 100 assets per page by default (max 5,000). Large tenants may require multiple calls. |
| Cortex - Diagnose Broker Collectors | Diagnoses collector errors on a Broker VM. | Audit log results limited to 100 rows per query; VM name must match exactly. |
| Cortex - Create War Room Entry | Adds a note to the War Room of one or more cases or issues. | Limited to 20 cases/issues per call; requires explicit user approval before running. |
| Cortex - Packs Version Check | Checks installed Marketplace content packs for available updates. | Reports all outdated packs in a single call. Read-only. |
| Cortex - Update Content Packs | Updates Marketplace content packs to their latest version. | Requires explicit user approval; aborts if breaking changes are detected unless overridden. |