Instructions

Overview

The Instructions view lets you manage the rules and guidance that shape how the agent behaves during investigations. You can browse project-level instructions, attach or detach them from the current investigation, and create new session-specific instructions on the fly. Instructions take effect immediately for any new rounds in the investigation.

Instruction Types

There are three instruction types, each represented by a color-coded badge:

• Automation Filter (purple) — rules that tell the agent which alerts to automatically investigate and which to ignore. These help reduce noise from known false positives and focus the agent on actionable incidents.
• Investigation Guidance (brown) — instructions that direct how the agent investigates, such as which tools to prefer, what areas to focus on, or domain-specific knowledge to apply during analysis.
• RCA Template (teal) — templates that structure the agent’s root cause analysis output by defining what sections to include and how findings should be organized in the final report.

Enabling and Disabling

Each instruction has a toggle that controls whether it is active for the current investigation. Click the toggle next to any instruction to attach or detach it. The list header shows a count of how many instructions are currently enabled out of the total available.

You can filter the list by All, Enabled, or Disabled to quickly find what you need. Clicking an instruction row expands it to show the full content, version number, and action buttons for copying or opening the instruction externally.

Session instructions you create via the composer at the bottom of the view are validated by the agent before being added. The composer provides a text area where you can type a new instruction, select its type, and submit it for validation. Once validated, the instruction appears in the list and can be toggled like any other.