AI Agents in Orchestration

overview ai agents are a special type of component in swimlane turbine marked and managed separately from regular components they appear as a dedicated section under the orchestration menu and are used in playbooks to create intelligent automation workflows by marking components as ai agents, you create a focused library of specialized components that are easily discoverable and used in playbooks why ai agents matter ai agents provide organizational benefits for managing your automation components reusable automation blocks build once, use across multiple playbooks organized component library easily discover and manage specialized components consistent naming and categorization group related automation building blocks together accessing ai agents navigation access ai agents through the main navigation navigate to orchestration in the left sidebar click on ai agents to view all components marked as ai agents empty state when you first access the ai agents section and no ai agents have been created yet, an empty state screen appears with title "get started with your first component" description information about components and their role in creating modular processes for playbooks action buttons browse the swimlane content explore pre built components from swimlane's content library create a component start building your first component from scratch creating an ai agent creating a new component as an ai agent create a new component directly from the ai agents page from ai agents empty state navigate to orchestration > ai agents click "create a component" or "browse the swimlane content" from the empty state screen when creating a component from the ai agents page, the "mark as ai agent" checkbox is checked by default from components page navigate to orchestration > components click "create a component" to start building a new component the "mark as ai agent" checkbox is unchecked by default when creating from the components page marking an existing component as an ai agent to convert an existing component into an ai agent navigate to components go to orchestration > components select an existing component to open it in the editor open component details the component editor opens with three main sections left panel add panel with actions , components , and ai agents tabs center canvas area for building the component workflow right panel component details panel access summary tab in the right panel, ensure the summary tab is selected (alongside assets , data , and associations tabs) enable ai agent checkbox scroll to the hero ai section in the summary tab check the "mark as ai agent" checkbox an information icon (ℹ️) next to the checkbox provides additional context ui changes when you check this box, notice the panel title changes from "component details" to "ai agent details" the breadcrumbs at the top of the page update to include "ai agents" if you uncheck it, the panel title and breadcrumbs revert to "component" save changes the component is automatically saved when you check the checkbox the component appears in the ai agents list and is available in the ai agents tab when adding actions to playbooks component requirements components must have a name (required) optional components include description (required if visibletoheroai is enabled) configuration notes (for hero ai context) schema/interface (if using intents) using ai agents in playbooks adding an ai agent to a playbook add ai agents to playbooks just like regular components open a playbook navigate to orchestration > playbooks create a new playbook or open an existing one open add panel click the "+" button on the canvas or use the add action panel the add panel appears on the left side with three tabs actions , components , and ai agents note the hero ai action has been moved to the top of the actions tab for better visibility select ai agents tab click on the ai agents tab in the add panel this tab displays all components that have been marked as ai agents search and select use the search box at the top of the ai agents tab to find the ai agent you want to use browse through the list of available ai agents click on an ai agent to add it to your playbook drag and drop (alternative) alternatively, drag an ai agent from the ai agents list directly onto the playbook canvas drop it on a playbook node or connection point visual identification when an ai agent is added to a playbook canvas the node type displays as "ai agent" instead of "component" ai agents have a distinct visual appearance with different icons compared to regular components the title and icon are updated to reflect the ai agent status connect them to other actions and triggers like regular components ai agent properties summary details when viewing or editing an ai agent component, the following properties are available basic information name component name (required) schema interface/intent name (if applicable, read only) description component description (large text area) configuration notes additional context for hero ai (optional, large text area) source indicates if component is custom or swimlane content (read only, displays as "user made" for custom components) hero ai the hero ai section in the summary tab contains the following settings mark as ai agent toggle that determines whether the component appears in the ai agents list when enabled, the component is categorized as an ai agent and the panel title changes to "ai agent details" with breadcrumbs updated visible to hero ai toggle that makes the component discoverable and executable by hero ai companion when enabled, hero ai companion uses the component during conversations when enabled, the component appears in the tools tab for hero ai native actions when disabled, removes the component as an available tool for hero ai companion requires confirmation to execute only visible when "visible to hero ai" is enabled requires hero ai companion to ask for confirmation before executing this component in the hero ai companion chat understanding the relationship "mark as ai agent" = categorizes the component as an ai agent, making it appear in the ai agents list and ai agents tab in playbooks "visible to hero ai" = makes components available to hero ai companion and also makes components appear in the tools tab for hero ai native actions these are independent settings—mark a component as an ai agent without enabling "visible to hero ai" , and vice versa filtering and searching ai agents list view the ai agents list supports filtering by source custom or swimlane content interface filter by intent/interface name created by filter by component creator search functionality use the search box at the top of the ai agents tab to quickly find specific agents search filters components by name and other metadata clear search to reset filters best practices when to use ai agents reusable automation blocks mark components that perform specific, well defined tasks as ai agents components that provide data or perform actions that might be useful in automation workflows specialized tool components components that query external systems (ti providers, user directories, etc ) components that perform analysis or correlation components that handle communication or notifications components that create or update records hero ai integration components that should be discoverable by hero ai companion components that work well with conversational ai interfaces components designed to be orchestrated by hero ai reasoning component design for ai agents 1\ clear descriptions and configuration notes the description and configuration notes are critical they help hero ai understand when and how to use your ai agent description explain what the ai agent does in clear, specific terms ✅ good "queries multiple threat intelligence providers for ip addresses, domains, and file hashes returns consolidated threat scores and reputation data " ❌ less effective "does threat intelligence" configuration notes provide additional context about when the ai agent should be used what scenarios it is best suited for any limitations or considerations example "use this agent when analyzing observables from security alerts best for ip addresses and domains takes 5 10 seconds for multiple providers " 2\ proper naming use descriptive names that indicate the ai agent's purpose follow consistent naming conventions (for example, "query threat intelligence", "check user activity") avoid generic names like "tool 1" or "component a" 3\ well defined schemas input schema clearly define what inputs the ai agent expects use descriptive field names include field descriptions specify required vs optional fields output schema clearly define what outputs the ai agent provides structure outputs logically include metadata that might be useful (for example, confidence scores, timestamps) make outputs easy for hero ai to interpret and use 4\ documentation document inputs, outputs, and behavior explain any ai specific features or requirements provide examples of when to use the ai agent document any dependencies or prerequisites building your ai agent library think of ai agents as building blocks for intelligent automation start with common tasks identify repetitive tasks in your soc workflows threat intelligence lookups user context checks system state queries communication tasks build specialized agents create focused ai agents for specific purposes one agent per tool/provider one agent per type of analysis one agent per communication channel organize and categorize use consistent naming and descriptions group related agents (for example, "ti virustotal", "ti abuseipdb") use prefixes or tags for organization test your ai agents test your ai agents in playbooks to ensure they work correctly verify that descriptions are clear and accurate ensure outputs are well structured and useful integration with hero ai hero ai companion components with "visible to hero ai" enabled discovered by hero ai companion during conversations executed by hero ai when appropriate used in automated workflows suggested by hero ai appear in the tools tab for hero ai native actions