AI Agents

AI Agents are reusable automation objects that define an AI model, credentials, system instructions, and the workflow tools the agent can use. Create an AI agent when you want the same agent identity and behavior to be available across multiple workflows without configuring the model, target, account key, instructions, and tools in each workflow. Agents can solve tasks defined in the prompt and instructions, and can execute other pre-selected workflows. This allows workflows to combine agentic and deterministic automation to maximize autonomy and control.

Previously, AI agent configuration was defined directly in an OpenAI activity on the workflow canvas. That meant the target, model, system instructions, user prompt, and other settings were stored inside one workflow activity. The reusable part of that configuration is now available for creating a top-level agent definition.

When a workflow uses an AI agent, the workflow activity references the saved agent definition. The workflow author provides only the runtime prompt and activity execution options. Workflows invoke the saved agent definition by name. You can design multiple workflows with the same agent. One target supports multiple agents.

You can view, create, and manage agents by navigating to Automate > Agents.

An AI agent has two parts:

  • The agent definition stores the reusable configuration, including the provider, model, target, account key, system instructions, workflow tools, and advanced settings.

  • The workflow activity stores runtime information for one workflow run, including the user prompt and optional previous response ID.

In the workflow editor, configured agents are available from the Agents section of the sidebar. Drag an agent onto the canvas to add an AI agent activity. The activity shows a summary of the saved agent configuration, but the reusable configuration remains read-only from the workflow activity.

Choose Automate > AI Agents to viewa list of the agents in your environment. The list shows the available agents and key details, including the model used, owner, and actions. Click the (Ellipsis) icon to see the actions menu. Available actions include:

  • Used by - Open a dialog box showing the objects, such as workflows, that use this agent.

  • Duplicate - Copy the agent and its configured properties.

  • Delete - Remove the agent. If you try to delete an AI agent that is being used, the system will prevent the deletion and it will fail.

Use the AI Agents list to find an existing agent before creating a new one. Agents are reusable, so an existing agent might already contain the provider, model, instructions, and workflow tools needed for your workflow.

Note:

Before You Begin:

  • Create or identify the target and account key that the agent will use to connect to the AI provider.

  • Decide which workflows or workflow categories the agent can use as tools.

  • Prepare the system instructions that define the agent's role, behavior, and limits.

  • Review existing agents before creating a new one. Agent names must be unique.

 

To create a new AI agent:

  1. In the AI Agents page click Create agent to open the New Agent form.

  2. Enter the general agent details:

    • Display Name:Required. This name will be displayed in workflows, runs, and audit logs, and should be unique.

    • Description: Required. Provide enough information to help other users understand when to use this agent.

    • Target: Required. The API endpoint called by this agent.

  3. Complete the target provider settings as needed:

    • Provider, Region, and Model: Choose the OpenAI model that will process the requests. The list of models is updated as new models become available. Models are grouped by provider.

    • Account Key: The credential the target uses for the provider.

    • Request: The information instructions that define how the agent should behave (such as role, context, and constraints) used by the system to process the requests. This shapes the tone, focus, and constraints for all responses in this workflow. For example, act as a cybersecurity analyst.

  4. Tools (workflows) - Specify the following information:

    Note: You must specify a minimum of one workflow or workflow category to include. Use the Ask AI activity if you do not want to use workflows. After you run a workflow with the AI agent activity, you can view the workflows executed and links to the runs on the Runs page.

    • Specific workflows to include:Select specific workflows to use during the execution of the workflow by the AI agent. Otherwise, no workflows are included. The AI agent waits for the selected workflows to complete. If the workflows do not finish by the defined timeout period, the agent will time out. Only Production Ready workflows are included.

    • Workflow categories to include - Select the workflow categories to use during the execution of the workflow by the AI agent. Otherwise, no workflow categories are included. The AI agent waits for the workflows in the selected categories to complete. If the workflows do not finish by the defined timeout period, the agent will time out. Only Production Ready workflows in the selected categories are included.

  5. Configure advanced settings as needed:

    • Maximum agent turns: The maximum number of turns the agent can take while responding.

    • Temperature (chat response variability) - Enter the variability of the AI responses, between 0 and 2, that controls creativity versus consistency in the AI answers. The lower the value, the output is more deterministic, focused, and consistent. The higher the value, there is an increase in the variability and creativity of the output. We recommend that you use a lower value for factual tasks. The default temperature is 1.

      • 0 - A precise variability that produces highly deterministic and focused responses, with minimal randomness. Best for scenarios where accuracy and predictability are critical. This can be used for fact-based outputs, summaries, or any context requiring strict adherence to the prompt.

      • 1 - A balance between creativity and focus. Outputs are still grounded but allow for some variety and flexibility. This can be used for general purpose conversations, moderate creativity, and informative responses.

      • 2 - A creative variability that encourages more creative and diverse outputs. It adds a level of randomness while still maintaining coherence. This can be used for brainstorming ideas, generating varied responses, or exploring multiple possibilities.

    • Max output tokens: The maximum response size.

    • Structured Output: Click Add to specify the JSON format for the AI model to use in the text responses. Enter the JSON key in the Field name field and choose the output data type in the Field type drop-down list (bool, integer, number, or string).

    • Advanced parameters: Model-dependent

    • Agent Timeout: In seconds

  6. Click Save.

The agent is added to the AI Agents list and can be selected from workflow AI Agent activities.

Cisco XDR validates the agent name when you create or rename an agent.

The target and account key are part of the agent definition. They are not configured separately in each workflow activity.

  • The target identifies the provider connection used by the agent.

  • The account key supplies the credential for the selected target.

  • The provider and model choices determine which models are available for the agent. For example, select OpenAI or Azure OpenAI as the provider, and then select one of the models available for that provider.

Because these settings are stored on the agent definition, changing them affects every workflow that references the agent the next time those workflows run.

Use system instructions to define the agent's identity, responsibilities, response style, and operating limits. System instructions are saved with the agent definition so the same instructions are used wherever the agent is referenced.

Workflow authors cannot override system instructions from the workflow activity. If an agent needs different instructions for a different use case, create a separate agent or duplicate an existing agent and edit the copy.

An AI agent can use selected workflows as tools. You can select individual workflows or categories of workflows, depending on how the tools are organized in your environment.

Use workflow tools and categories to control what the agent is allowed to call. Add only the workflows the agent needs for its purpose. If you change the selected tools or categories later, the change applies to all workflows that reference the agent at their next execution.

  1. Open or create a workflow.

  2. In the Workflow Editor, open the Agents section of the sidebar.

  3. Drag and drop an agent onto the canvas.

  4. Enter a Display Name, and select or confirm the agent definition.

  5. Review the read-only agent summary, including the model, tools, and system instruction preview.

  6. Configure the activity-level fields:

    • Runtime Prompt (User Prompt): The prompt sent to the agent at run time. This field supports workflow variables and can reference workflow input values.

    • Activity execution controls, such as timeout, continue-on-failure, and skip.

  7. Validate the workflow.

You can also add an AI Agent activity to the canvas and then select the agent definition by name.

The workflow activity requires an Agent and a Runtime Prompt (User Prompt). The model, provider, target, account key, system instructions, workflow tools, temperature, and max agent turns are controlled by the agent definition and cannot be edited from the workflow activity.

When an AI Agent activity references an agent definition, the workflow editor shows the agent's saved configuration as read-only information. Use this summary to confirm which agent the activity uses and how the agent is configured.

The summary can include details such as:

  • Model and provider

  • Workflow tools or categories

  • System instruction preview

  • Target and account key reference

To change these settings, edit the agent definition from Automate > AI Agents. Changes made to the agent definition apply to all workflows that reference the agent at their next execution.

The user prompt is the dynamic input that the workflow sends to the agent at run time. Use it for information that changes from one workflow run to another.

For example, the user prompt can include workflow variables or values collected earlier in the workflow. Keep reusable identity and behavior instructions in the agent definition's system instructions, and keep run-specific instructions in the workflow activity's user prompt.

  1. Choose Automate > AI Agents.

  2. Select the agent to open the Edit AI form.

  3. Update the agent settings.

  4. When finished, click Save.

The agent details show when the agent was last edited and who edited it.

Editing an agent definition updates the central definition used by all referencing workflow activities. When you save agent configuration changes, Cisco XDR warns you that workflows can be affected. The updated definition is used the next time those workflows run. Workflows do not keep a pinned copy of the previous agent definition.

Before changing a shared agent, review the usage count and the list of referencing workflows. Changes to provider, model, target, account key, system instructions, workflow tools, temperature, max output tokens, or max agent turns can change workflow results.

  1. Choose Automate > AI Agents and locate the agent to be deleted.

  2. To view any referencing workflows, click the (Ellipsis) icon to open the agent's actions menu, and select Used by. (AI agents that are used by one or more workflows cannot be deleted; the action will fail. The agent must first be removed from the workflow before it can be deleted altogether.)

  3. In the list, click the agent name to open the Edit form.

  4. Update the agent settings and click Save.

If a workflow contains a legacy inline AI Agent activity, use Save as Agent to convert the reusable parts of that activity into an AI Agent definition.

The agent identity fields, including target, account key, provider, model, system instructions, tools, and advanced settings, are saved to the agent definition. The activity-specific User Prompt remains on the workflow activity.

After you save the agent definition, the workflow activity references the new agent by name.

Some agents can be provided as system agents. System agents are read-only. To customize a system agent, duplicate it and edit the custom copy.