Torq allows users to build custom AI Agents within its automation platform, providing a flexible and intuitive way to embed intelligent, context-aware decision-making into workflows. Unlike traditional deterministic automation, where actions follow predefined, static logic, AI Agents leverage AI models to make dynamic decisions based on real-time data, natural language inputs, and changing conditions. Users can define each Agent’s mission, choose their preferred model, configure the tools it can use, and easily integrate the Agent into new or existing workflows. This combination significantly enhances automation depth, adaptability, and responsiveness.

Key benefits include:

Mission-Driven Behavior: Define the AI Agent’s objective using a natural-language mission statement. This tells the Agent what it’s meant to do, whether it’s summarizing alerts, drafting responses, prioritizing incidents, or triaging complex cases.
Simplified Workflow Design: Define the desired outcome, AI Agents handle the logic, tool selection, and execution automatically.
Model Flexibility: Choose from a list of supported AI models (e.g., OpenAI, Claude, or your AI model subscription), allowing users to tailor performance, cost, and data privacy to their organization’s needs.
AI Tools: AI Agents in Torq are seamlessly connected to the platform’s workflow engine through tools. The tools are workflows or single steps that the AI Agent can call dynamically during its execution. Acting as functional building blocks, they enable the agent to interact with external systems, process and transform data, or trigger follow-up automations.

Transparency in execution and decision-making

Torq invested deeply in features that make AI Agent behavior clear, auditable, and trustworthy, because trusted AI starts with explainability and transparency.

This means that every action taken by an AI Agent in Torq can be traced and understood:

Full Visibility into Decision-Making: Users can inspect instructions, tool selections, and execution Action Flow to understand why the Agent acted the way it did.
Real-Time Streaming: Watch AI Agent actions as they happen. During single-step or full workflow execution, open the Action Flow view to stream the agent’s operations live, providing immediate visibility into decisions, tool calls, and outputs.
Auditable Records: All inputs, outputs, and interactions are logged and preserved, making it possible to review and validate Agent behavior at any time.
Human-readable Insights: Instead of black-box automation, Torq surfaces context, rationales, and step-by-step activity so users remain in control.
Guardrails and Constraints: Clear behavioral guidelines ensure Agents operate within the policies and boundaries defined by your organization.

By combining explainability with transparency, we enable Security Operations teams to adopt AI confidently. The aim isn’t only to build powerful AI, but one that’s dependable, accountable, and safe for critical security use cases.

Ultimate flexibility

AI Agents in Torq give you the flexibility of large language models while keeping everything visible and auditable within your workflow. You get the dynamic reasoning power of AI paired with the predictability and control of deterministic automation. It’s the best of both worlds: Agents can adapt to different scenarios, but you still have complete visibility into their decisions, tool usage, and output through execution logs.

This makes AI Agents ideal for situations where logic needs to shift based on context, but where oversight is still essential for security, compliance, or reliability.

For example, the Suspicious Activity Agent helps analyze and enrich ambiguous security alerts (unusual logins, strange file activity, or odd network behavior). It reads alert metadata, enriches with tools, then evaluates patterns (e.g., login times or device anomalies) to provide a summary and initial verdict.

This flexible Agent can be used across multiple workflows: SIEM alert triage, XDR/EDR detection handling, incident response automation, or even Slack/email alert triggers.

How to use

AI Agents operate autonomously, leveraging deterministic workflows as tools to carry out tasks with precision and consistency. Once it’s set up, the Agent runs on its own, using the tools, analyzing the context, and doing what’s needed to reach its goal, whether taking action or making a smart decision.

Open or create a workflow: In your workspace, open an existing workflow or create a new one to get started.
Add an AI Agent to your workflow: From the Builderbox, click the AI Agents section, select a Custom or Templates tab, and drag an AI Agent onto the Workflow Canvas.
Configure the AI Agent: Click on the AI Agent you just added, then select Configure Agent to set it up.
Instructions tab: Fill out the Agent Instructions (These are suggestions; complete only the sections relevant to your Agent.). For details, see AI Agent Instructions: Writing a Mission Statement.
- Role: Define the AI Agent’s persona (e.g., "security analyst", "support engineer").
- Supported Scenario: Define the specific use case or situation in which an AI Agent is expected to operate.
- Behavior Guidelines: Provide structured instructions that define how an AI Agent should act, communicate, and make decisions within a workflow. They help shape the Agent's tone, reasoning style, interaction patterns, and safety boundaries.
- Context: Provide relevant context from earlier steps or external sources (e.g., ticket descriptions, threat data, user info).
- Subscription: Choose the subscription you want to use, either Torq’s default model or any custom AI subscription you’ve added through provider integrations.
- AI Model: Choose the AI model the Agent will use to make decisions.
Toolbox tab: Click Add Tool and select which workflows, steps, cases or utilities the AI Agent can use. For details, see AI Tools: Enhancing AI Agent Capabilities.
Stream agent execution in real time: Select the AI Agent step in your workflow, click the Execute button to see the agent’s actions stream live, including inputs, outputs, and tool calls, as they occur.
Action Flow view: After the AI Agent step runs, open the Execution Log and switch to Action View. This provides a complete picture of the agent’s execution, including its inputs, outputs, and any tool calls made during the process. See the Validate and Debug with Action Flow section below.
- Input: View the context and instructions that the Agent needs to operate.
- Output: Use it to validate its decisions and tool usage before going live, and to debug behavior by tracing its reasoning and identifying any misconfigurations or unexpected outputs.
  Reasoning entries may be absent from the output log if the AI Agent decides not to include them.
- Tools (Workflows, Steps, Cases or Utilities): Explore the AI Agent's pre-configured actions to gather data, perform lookups, and enrich information within a Torq workflow.
  Tool usage is limited to 15 tool calls per AI Agent execution.
Continue configuring workflow steps: Finish setting up the remaining steps in the workflow.
Track AI Agent executions: Open the Activity Log to see all executions associated with AI Agents. Entries are labeled to make the source clear:
- Step executions within workflows: Labeled as <workflow_name> / Agent Step Execution, showing the AI Agent as the event source.
- Workflow executions by AI Agents: Labeled with the <workflow_name> and the AI Agent as the event source.
- Manual executions by users: Labeled as <workflow_name> / Manual Step Execution, with the initiating user listed as the event source.

Workflows that include AI Agents are restricted to the workspace where they were created and cannot be shared with other workspaces.

Validate and debug with Action Flow

The Action Flow shows how an AI Agent processes and executes within a workflow. It typically includes three parts:

Input: Summary of the Agent’s role, objective, tools, and the raw event or alert data it will work with.
Reasoning Log: A step-by-step explanation of the Agent’s decision-making, often in natural language. Reasoning entries may not appear in the Action Flow if the AI Agent chooses not to include them.
Output: The result produced after the Agent processes the input and executes any selected tools.
The output can be passed seamlessly into subsequent workflow steps, such as conditional logic, ticket creation, or notifications, bridging AI-driven reasoning with deterministic automation.
- Summary: A neutral, fact-based recap of what the Agent did during the workflow step, including the data it gathered, the tools it used, and key contextual information.
- Conclusion: The AI Agent’s interpretation and judgment are based on all the data it has gathered and enriched. It represents the Agent's assessment of the incident or alert.

Access the Action Flow: Open the Execution Log and click Action Flow to:

Validate decisions and tool usage: Review the visual execution flow to confirm the Agent’s reasoning, verify tool selection, and ensure it behaves as expected before deploying to production.
Debug Agent behavior: Trace the Agent’s thought process and see which tools were triggered. This makes it easier to spot misconfigurations, logic gaps, or unexpected model outputs quickly.

Bring Your Own Subscription (BYOS)

Torq supports Bring Your Own Subscription (BYOS) for AI models. For details, see AI Models: Bring Your Own Subscription (BYOS).

Templates and custom AI Agents

Torq enables security teams to create and customize AI-powered agents that automate key SOC tasks, from enrichment and analysis to end-user interaction.

Agent templates

Agent templates are preconfigured AI agents designed to automate and streamline common security operations use cases out of the box. Each template includes a predefined role, purpose, and basic configuration, which can be further adapted or extended to your environment. Below are examples of available templates.

End User Interviewer

Delivers structured end-user interviews. The End User Interviewer is an AI-driven assistant that guides users through clear, friendly Q&A to validate suspicious activity and security alerts. It helps SOC teams collect accurate, consistent incident context with minimal effort by generating ready-to-use interview transcripts.

VirusTotal IOC Enricher

Enhances incident context by enriching Indicators of Compromise (IOCs) through the VirusTotal API. For educational and analytical purposes, this agent automatically extracts IOCs from alerts and enriches them with VirusTotal data. It provides deeper visibility into threat context, helping analysts assess and prioritize alerts more efficiently.

SOC Posture Report Generator

Delivers daily operational summaries and insights directly within Slack. The SOC Posture Report Generator is an AI-driven assistant that tracks and summarizes case activity, produces actionable insights, and highlights emerging trends. It helps SOC leads and CISOs stay informed with minimal effort by providing automated daily updates.

Custom AI Agent

Custom AI Agent is created when you take an existing agent template or start from a blank AI Agent step and save it as a new reusable agent. Once saved, the custom agent retains all configured instructions, tools, and behaviors, making it available for reuse across the workspace without additional setup.

Additional documentation

Now that you’ve learned the basics of building AI Agents in workflows, explore the following resources to deepen your understanding and improve your implementations:

AI Agent Instructions: Learn how to define your AI Agent’s role, goal, and scope in natural language.
AI Tools: Enhance your AI Agent’s capabilities by adding workflows or individual steps it can call during reasoning and execution.
Use Case: Automate SOC Triage with AI Agents: Walk through a real-world example to see how AI Agents are used in a complete workflow.
Bring Your Own Subscription (BYOS): Learn how to use your own AI provider subscriptions to power Agents with the models, pricing, and compliance controls that fit your organization.
AI Agent FAQs: Find answers to common questions around capabilities, guardrails, and troubleshooting.