> ## Documentation Index
> Fetch the complete documentation index at: https://docs.cotool.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# What is an Agent?

> Understanding AI agents in Cotool

An **agent** is an AI-powered workflow that can reason, make decisions, and take actions across your security stack. Unlike traditional automation that follows predefined logic, agents use Large Language Models (LLMs) to understand context, plan their actions, and adapt to different situations.

## How Agents Work

Agents combine four key components:

<AccordionGroup>
  <Accordion title="Large Language Models (LLMs)" icon="brain">
    Agents use state-of-the-art LLMs (hosted or custom) to:

    * Understand natural language instructions
    * Reason about complex problems
    * Decide which tools to use and when
    * Generate human-readable summaries
  </Accordion>

  <Accordion title="Tools" icon="wrench">
    Tools are structured functions that agents can call to:

    * Query APIs (search Splunk logs, list SentinelOne alerts)
    * Take actions (create Jira tickets, send Slack messages)
    * Transform data (parse emails, extract indicators)
    * Access context (fetch documents, reference tool data)
  </Accordion>

  <Accordion title="Context" icon="book">
    Agents can access relevant context from:

    * Google Docs and Notion pages (runbooks, policies)
    * Integration data (user info, asset inventories)
    * Trigger payloads (the event that invoked them)
  </Accordion>

  <Accordion title="Instructions (System Prompts)" icon="message-lines">
    System prompts guide agent behavior by defining:

    * The agent's role and responsibilities
    * When and how to use tools
    * Output format and tone
    * Decision-making criteria
  </Accordion>
</AccordionGroup>

## Agent Execution Flow

When an agent runs, it follows this lifecycle:

<Steps>
  <Step title="Invocation">
    Agent receives a task from:

    * **Trigger** (Jira issue created, Slack mention, cron schedule)
    * **Chat** (user asks a question in the UI)
    * **API call** (programmatic invocation)
  </Step>

  <Step title="Context Loading">
    Agent loads relevant context:

    * System prompt and configuration
    * Context documents (Google Docs, Notion)
    * Trigger payload data
  </Step>

  <Step title="Planning (Optional)">
    If planning mode is enabled, the agent:

    * Analyzes the task
    * Creates a step-by-step plan
    * Identifies required tools and information
  </Step>

  <Step title="Execution Loop">
    Agent iteratively:

    * Decides next action (call a tool or respond)
    * Calls tools to gather data or take actions
    * Evaluates results and plans next steps
    * Continues until task is complete
  </Step>

  <Step title="Response">
    Agent produces output:

    * Text summary of findings and actions
    * Structured data (JSON, tables, charts)
    * Side effects (tickets created, messages sent)
  </Step>
</Steps>

## Agent Types

Cotool supports two primary agent modes:

<Tabs>
  <Tab title="Autonomous Agents">
    **Autonomous agents** run without human intervention, triggered automatically by events.

    **Examples:**

    * Alert triage (triggered by security alerts)
    * Ticket enrichment (triggered when Jira issues are created)
    * Scheduled reports (triggered by cron)
    * Phishing analysis (triggered by emails)
  </Tab>

  <Tab title="Copilot Agents">
    **Copilot agents** assist humans interactively through chat or API.

    **Examples:**

    * Ad-hoc investigations
    * Complex troubleshooting
    * Research and data gathering
    * Report generation
  </Tab>
</Tabs>

## Key Capabilities

<CardGroup cols={2}>
  <Card title="Multi-Tool Orchestration" icon="diagram-project">
    Agents can coordinate across dozens of tools in a single run, fetching data from Splunk, enriching with VirusTotal, and updating Jira—all autonomously.
  </Card>

  <Card title="Adaptive Reasoning" icon="lightbulb">
    Agents adapt their approach based on what they discover. If one data source is unavailable, they can pivot to alternatives.
  </Card>

  <Card title="Context-Aware" icon="brain-circuit">
    Agents can reference organizational knowledge stored in documents, prompts, and live integration data.
  </Card>

  <Card title="Auditable & Safe" icon="shield-check">
    Every tool call is logged. Agents only have access to explicitly granted tools and integrations.
  </Card>
</CardGroup>