AI Agents in Orchestration

overview ai agents are a special type of component in swimlane turbine marked and managed separately from regular components they appear as a dedicated section under the orchestration menu and are used in playbooks to create intelligent automation workflows by marking components as ai agents, you create a focused library of specialized components that are easily discoverable and used in playbooks why ai agents matter ai agents provide organizational benefits for managing your automation components reusable automation blocks build once, use across multiple playbooks organized component library easily discover and manage specialized components consistent naming and categorization group related automation building blocks together accessing ai agents navigation access ai agents through the main navigation navigate to orchestration in the left sidebar click on ai agents to view all components marked as ai agents empty state when you first access the ai agents section and no ai agents have been created yet, an empty state screen appears with title "get started with your first component" description information about components and their role in creating modular processes for playbooks action buttons browse the swimlane content explore pre built components from swimlane's content library create a component start building your first component from scratch creating an ai agent creating a new component as an ai agent create a new component directly from the ai agents page from ai agents empty state navigate to orchestration > ai agents click "create a component" or "browse the swimlane content" from the empty state screen when creating a component from the ai agents page, the "mark as ai agent" checkbox is checked by default from components page navigate to orchestration > components click "create a component" to start building a new component the "mark as ai agent" checkbox is unchecked by default when creating from the components page marking an existing component as an ai agent to convert an existing component into an ai agent navigate to components go to orchestration > components select an existing component to open it in the editor open component details the component editor opens with three main sections left panel add panel with actions , components , and ai agents tabs center canvas area for building the component workflow right panel component details panel access summary tab in the right panel, ensure the summary tab is selected (alongside assets , data , and associations tabs) enable ai agent checkbox scroll to the hero ai section in the summary tab check the "mark as ai agent" checkbox an information icon (ℹ️) next to the checkbox provides additional context ui changes when you check this box, notice the panel title changes from "component details" to "ai agent details" the breadcrumbs at the top of the page update to include "ai agents" if you uncheck it, the panel title and breadcrumbs revert to "component" save changes the component is automatically saved when you check the checkbox the component appears in the ai agents list and is available in the ai agents tab when adding actions to playbooks component requirements components must have a name (required) optional components include description (required if visibletoheroai is enabled) configuration notes (for hero ai context) schema/interface (if using intents) using ai agents in playbooks adding an ai agent to a playbook add ai agents to playbooks just like regular components open a playbook navigate to orchestration > playbooks create a new playbook or open an existing one open add panel click the "+" button on the canvas or use the add action panel the add panel appears on the left side with three tabs actions , components , and ai agents note the hero ai action has been moved to the top of the actions tab for better visibility select ai agents tab click on the ai agents tab in the add panel this tab displays all components that have been marked as ai agents search and select use the search box at the top of the ai agents tab to find the ai agent you want to use browse through the list of available ai agents click on an ai agent to add it to your playbook drag and drop (alternative) alternatively, drag an ai agent from the ai agents list directly onto the playbook canvas drop it on a playbook node or connection point visual identification when an ai agent is added to a playbook canvas the node type displays as "ai agent" instead of "component" ai agents have a distinct visual appearance with different icons compared to regular components the title and icon are updated to reflect the ai agent status connect them to other actions and triggers like regular components ai agent properties summary details when viewing or editing an ai agent component, the following properties are available basic information name component name (required) schema interface/intent name (if applicable, read only) description component description (large text area) configuration notes additional context for hero ai (optional, large text area) source indicates if component is custom or swimlane content (read only, displays as "user made" for custom components) hero ai the hero ai section in the summary tab contains the following settings mark as ai agent toggle that determines whether the component appears in the ai agents list when enabled, the component is categorized as an ai agent and the panel title changes to "ai agent details" with breadcrumbs updated visible to hero ai toggle that makes the component discoverable and executable by hero ai companion when enabled, hero ai companion uses the component during conversations when enabled, the component appears in the tools tab for hero ai native actions when disabled, removes the component as an available tool for hero ai companion requires confirmation to execute only visible when "visible to hero ai" is enabled requires hero ai companion to ask for confirmation before executing this component in the hero ai companion chat understanding the relationship "mark as ai agent" = categorizes the component as an ai agent, making it appear in the ai agents list and ai agents tab in playbooks "visible to hero ai" = makes components available to hero ai companion and also makes components appear in the tools tab for hero ai native actions these are independent settings—mark a component as an ai agent without enabling "visible to hero ai" , and vice versa ai agents listing page the ai agents listing page provides a centralized view of all ai agents available in your environment from this page, you can search for ai agents, apply filters, review ai agent details, and perform common management actions to access the ai agents listing page log in to turbine from the left navigation pane, select orchestration click ai agents search ai agents use the search bar in the upper right corner of the page to quickly locate ai agents you can search by ai agent name ai agent description the ai agent list updates to display matching results as you type filter ai agents use the filters at the top of the page to narrow the list of ai agents created the created filter displays ai agents based on when they were created select one of the available relative time ranges, including last 15 minutes last 30 minutes last 1 hour last 5 hours last 10 hours last 24 hours today yesterday last 2 days last 3 days last 7 days this week last week this month last month this year you can also select custom range to specify a start date and end date after selecting a range, click apply to update the list created by the created by filter displays ai agents created by specific users you can search for a user by name select one or more users select all to display ai agents created by every user last updated the last updated filter works the same way as the created filter filter ai agents based on when they were last modified by selecting a predefined relative time range or a custom date range, then click apply last updated by the last updated by filter works the same way as the created by filter search for one or more users and select them to display ai agents last updated by those users source use the source filter to display ai agents based on their source available options include custom — ai agents created by users swimlane content — ai agents provided by swimlane you can search for a source and select one or more options interface use the interface filter to display ai agents associated with specific interfaces you can search for an interface select one or more interfaces select all to display ai agents with any interface visible to hero ai use the visible to hero ai filter to display ai agents based on whether they are available for hero ai available options include yes no select one or more values to filter the ai agent list sort ai agents click the last updated column heading to sort the ai agent list by the date the ai agents were last modified click the column heading again to reverse the sort order ai agent list columns the ai agents listing page displays the following information for each ai agent column description name displays the ai agent name the ai agent source (for example, custom ) is displayed below the name created date the ai agent was created created by user who created the ai agent last updated date the ai agent was last modified last updated by user who last modified the ai agent interface the interface assigned to the ai agent visible to hero ai indicates whether the ai agent is available for use with hero ai ai agent actions each ai agent includes a more options (⋮) menu that provides additional management actions action description export export the ai agent duplicate create a copy of the ai agent delete permanently delete the ai agent by default, all filters are set to all , and the page displays all ai agents that you have permission to view you can apply multiple filters at the same time and use search with filters the search bar searches only the ai agent name and description to reset a filter, select all from the corresponding filter dropdown best practices when to use ai agents reusable automation blocks mark components that perform specific, well defined tasks as ai agents components that provide data or perform actions that might be useful in automation workflows specialized tool components components that query external systems (ti providers, user directories, and similar) components that perform analysis or correlation components that handle communication or notifications components that create or update records hero ai integration components that should be discoverable by hero ai companion components that work well with conversational ai interfaces components designed to be orchestrated by hero ai reasoning component design for ai agents 1\ clear descriptions and configuration notes the description and configuration notes are critical they help hero ai understand when and how to use your ai agent description explain what the ai agent does in clear, specific terms ✅ good "queries multiple threat intelligence providers for ip addresses, domains, and file hashes returns consolidated threat scores and reputation data " ❌ less effective "does threat intelligence" configuration notes provide additional context about when the ai agent should be used what scenarios it is best suited for any limitations or considerations example "use this agent when analyzing observables from security alerts best for ip addresses and domains takes 5 10 seconds for multiple providers " 2\ proper naming use descriptive names that indicate the ai agent's purpose follow consistent naming conventions (for example, "query threat intelligence", "check user activity") avoid generic names like "tool 1" or "component a" 3\ well defined schemas input schema clearly define what inputs the ai agent expects use descriptive field names include field descriptions specify required vs optional fields output schema clearly define what outputs the ai agent provides structure outputs logically include metadata that might be useful (for example, confidence scores, timestamps) make outputs easy for hero ai to interpret and use 4\ documentation document inputs, outputs, and behavior explain any ai specific features or requirements provide examples of when to use the ai agent document any dependencies or prerequisites building your ai agent library think of ai agents as building blocks for intelligent automation start with common tasks identify repetitive tasks in your soc workflows threat intelligence lookups user context checks system state queries communication tasks build specialized agents create focused ai agents for specific purposes one agent per tool/provider one agent per type of analysis one agent per communication channel organize and categorize use consistent naming and descriptions group related agents (for example, "ti virustotal", "ti abuseipdb") use prefixes or tags for organization test your ai agents test your ai agents in playbooks to ensure they work correctly verify that descriptions are clear and accurate ensure outputs are well structured and useful integration with hero ai hero ai companion components with "visible to hero ai" enabled discovered by hero ai companion during conversations executed by hero ai when appropriate used in automated workflows suggested by hero ai appear in the tools tab for hero ai native actions