Skip to main content
Tools are the bridge between agent intelligence and real-world actions. Each tool is a structured function that agents can call to interact with your security stack, query data, or automate workflows.

​
What Are Tools?

Tools are discrete, well-defined actions that agents can perform. Each tool:
  • Has a clear purpose (e.g., “Search Splunk logs”, “Create Jira ticket”)
  • Accepts typed parameters (search query, ticket title, etc.)
  • Returns structured data that agents can reason about
  • Is authenticated and scoped to your organization
Think of tools as the agent’s hands - they allow it to interact with the world beyond just thinking and reasoning.

​
How Agents Use Tools

Agents decide which tools to use based on:
1

Task Understanding

Agent analyzes the task and identifies what information it needs or what actions it should take.
2

Tool Selection

Agent chooses relevant tools from its available toolset based on the tool descriptions and current context.
3

Parameter Construction

Agent constructs appropriate parameters for the tool call (e.g., search query, filters, identifiers).
4

Execution

Tool is invoked with the provided parameters. The integration handles authentication and API calls.
5

Result Processing

Agent receives structured results and incorporates them into its reasoning for next steps.

​
Integrations vs Tools

It’s important to understand the distinction:
Integrations are authenticated connections to external services.
  • You authenticate once (OAuth, API key)
  • Credentials are stored securely
  • One integration can power multiple tools
  • Example: The Jira integration powers tools like:
    • create_jira_ticket
    • update_jira_ticket
    • list_jira_issues
    • add_jira_comment

​
Granting Tool Access

Agents only have access to tools you explicitly grant. When creating or editing an agent:
  1. Browse available tools by category or integration
  2. Select which tools the agent can use
  3. Agent can only call tools in its allowed list
Agents cannot discover or use tools they haven’t been granted. This prevents unintended actions from being taken by agents.