> For the complete documentation index, see [llms.txt](https://docs.sola.security/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.sola.security/workspace/agents.md). # Agents Agents are AI-powered intelligence units that reason and act on your behalf. Use them to investigate alerts, triage incidents, and take action across your connected data, each with its own instructions, tools, and memory.

{% hint style="info" %} Agents are [available on paid plans](https://sola.security/pricing/). {% endhint %} {% embed url="" %} ## Adding agents Install a pre-built ready to use agent or create a custom agent built for your team's specific workflows and needs. Creating, editing, and managing agents requires Owner or Admin access. To add an agent, go to **Agents** and click **Add agent**. You can also create an agent directly from Sola AI by describing the agent you need in the chat. ### Installing pre-built agents Browse ready-made agents from Sola, each designed and tested for a specific security domain. Installing one makes it immediately available to everyone in your workspace.

#### Available agents


Tier 1 Investigator Triages vendor alerts, enriches IOCs, and delivers a T1 summary with an escalate, close, or monitor recommendation.	https://app.sola.security/agents?gallery=&galleryAgent=6a2af95457ccaa1217955493
IT Security Audits identity and endpoint hygiene across your stack: MFA gaps, dormant accounts, privileged access sprawl, and offboarding exposure.	https://app.sola.security/agents?gallery=&galleryAgent=6a37dc4133322fe92aed6b59
Offboarding Risk Monitoring Identifies upcoming and recent leavers and flags terminated users with active access or ongoing exposure.	https://app.sola.security/agents?gallery=&galleryAgent=6a2ac3681b88b3a42533f7da

Tier 1 Investigator
Triages vendor alerts, enriches IOCs, and delivers a T1 summary with an escalate, close, or monitor recommendation.

https://app.sola.security/agents?gallery=&galleryAgent=6a2af95457ccaa1217955493

IT Security
Audits identity and endpoint hygiene across your stack: MFA gaps, dormant accounts, privileged access sprawl, and offboarding exposure.

https://app.sola.security/agents?gallery=&galleryAgent=6a37dc4133322fe92aed6b59

Offboarding Risk Monitoring

Identifies upcoming and recent leavers and flags terminated users with active access or ongoing exposure.

https://app.sola.security/agents?gallery=&galleryAgent=6a2ac3681b88b3a42533f7da

### Creating custom agents Custom agents give you full control over how an agent thinks, what it can access, and how it behaves. Each custom agent has its own instructions, tools, and [skills](#skills), and is available in your workspace to your entire team. #### **Tools** * **Web search** - Search the web for up-to-date information * **Canvases** - Generate and save visual canvases * **Alerts** - Set up recurring alerts based on findings * **Workflows** - Create and modify automated workflows * **Slack** - Send messages and interact with Slack * **Jira** - Create and update Jira issues * **AbuseIPDB** - Query IP reputation data from AbuseIPDB * **Shodan** - Search internet-connected devices via Shodan {% hint style="info" %} Agents always run within the scope of the chat or project they're called from, and can only access the tools you explicitly allow. They do not own data. {% endhint %} #### Skills [Skills](/workspace/skills.md) are domain-specific instruction sets that shape how an agent handles specific scenarios. Assigning skills to an agent extends its knowledge beyond its core instructions, without having to rewrite them. Select from skills already installed in your workspace, or add new ones. {% hint style="info" %} **Disabling skills** To disable a skill, remove it from any active agents first. {% endhint %} #### Instructions Instructions are the agent's system prompt. They define its role, what it should and shouldn't do, and how it should communicate. The more specific your instructions, the more consistently the agent will behave. * Role & responsibility: The agent's primary goal and area of focus. * Constraints and limitations: What the agent should and should not do. * Response style: How the agent should communicate and format its output. ## Invoking an agent When you @mention an agent in chat, it receives your message, reasons over it using its approved tools and connected data, and returns a response in the thread. Agents run asynchronously. You can continue your conversation while the agent works. **To invoke an agent**, type @ in the chat input to open the agent picker. Select the agent, add your message, and send. You can continue your main chat while the agent works. When the agent is ready, its response will appear in the thread referencing your original message.

{% hint style="info" %} **Active agents**\ When an agent is running, an indicator bar appears above the chat input, allowing you to monitor active sessions. {% endhint %} ## Agent memory Agents remember context across chat sessions. Memory is a persistent store the agent reads and writes across conversations, it retains relevant information from past interactions and applies it to new ones, without you having to repeat yourself. The agent updates its memory independently when it determines that information is worth keeping, such as confirmed findings, preferences, or decisions made during an investigation. You can also explicitly ask an agent to remember something. ## Managing agents The Agents page gives you a workspace-wide view of all installed and custom agents. From here you can see what's active, control which agents are enabled, and manage settings for each one. **To manage your agents**, go to ***Agents***. From the Agents page you can: * See all installed and custom agents at a glance. * Enable or disable any agent. * Try in project, Try in chat, Edit, Duplicate, or Delete. * Add new agents. ## Agents, workflows, and skills **Agents think. Workflows orchestrate. Skills guide.** **Agents** reason dynamically and act on your behalf across connected tools and data. @mention them in chat to investigate, triage, and take action. They are best for open-ended investigations and flexible tasks. [**Workflows**](/workspace/projects/workflows.md) execute a predefined sequence of steps in a specific order. Trigger them manually or on a schedule to automate repeatable tasks. They are best for repeatable, structured automations. [**Skills**](#skills) shape how an agent or Sola AI behaves in a specific domain. Assign them to an agent or apply them in chat to extend its knowledge. They are best for specializing an agent's focus or expertise. *** ## FAQs ### How are agents different from workflows? Agents and workflows are complementary, not interchangeable. Agents reason dynamically: given a question, they decide how to investigate and respond. Workflows execute a predefined sequence of steps in a specific order. Use agents for open-ended investigations and flexible tasks. Use workflows for repeatable, structured automations where each step is defined in advance. ### How are agents different from skills? [Skills](/workspace/skills.md) are instruction sets that shape how an agent (or Sola AI) behaves in a specific domain. An agent is the actor, with its own role, memory, and approved tools. A skill is a specialization applied on top. You can assign multiple skills to a single agent to broaden what it knows. ### Does the agent have access to all my data? No. Agents do not own or have standing access to data. When invoked, an agent runs within the context of the chat or project it's called from, and can only access the data sources and connectors available in that context. You control which tools the agent can use when you configure it. ### Can I invoke multiple agents in the same chat? Yes. You can @mention different agents within the same chat. Each invocation runs independently. The active agents indicator bar above the chat input shows which agents are currently running. ### What happens when an agent creates an artifact? By default, agents suggest artifacts (queries, canvases, alerts, or workflows) and wait for your confirmation before saving them. This keeps your workspace clean and ensures you stay in control of what's created. ### Can an agent remember something specific about how I work? Yes. You can tell an agent to remember something directly in the conversation: "Remember that we always exclude test accounts from user audits." The agent will store this in its memory and apply it in future sessions. Memories are shared across all workspace members who invoke the agent. ### Who can create and manage agents? Owners and Admins can create, add, edit, delete, duplicate, manage, and invoke agents. Contributors can invoke agents via @mention.
--- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://docs.sola.security/workspace/agents.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.