diff --git a/agents.md b/agents.md index 6a37b9d6..3e8dc983 100644 --- a/agents.md +++ b/agents.md @@ -711,3 +711,90 @@ No unresolved reviewer comments on the PR. No screenshots marked for documentati * `OIQ-AI-service`, `oiq-resources` - no commits. No unresolved reviewer comments on the PR. No screenshots marked for documentation use. Assignees unchanged. + +### 2026-10-14 - daily scan (since 2026-10-13 06:09), doc changes made + +* `Artemis` - #476 (Gavriel-M, ORIONIQ-1823): the `oiq-marketplace-free-trial` flag is removed, so the free trial is on for every account. Closes the open item from 2026-10-12. Added a **Free trial** section to `marketplace.md`. Source of wording: `AgentCommon/constants.ts` (`FREE_TRIAL_MESSAGES`) and `free-trial.util.ts`. The free run count and per-run price are template and Consul data, so the section does not quote them. + * #438 (yotamloe, ORIONIQ-1433, ORIONIQ-1772): agent memory, with a Memory **Agent docs** tab and a "Remember between runs" toggle in the agent editor. Not documented. Real memory still needs the per-account `oiq-agent-docs` flag and ai-service 3.12.0 in the region, so it is a staged rollout. Revisit when the flag is removed. `memory.md` stays accurate for account and user documents. + * #473 and #475 (Gavriel-M, ORIONIQ-1811): `GET /orioniq-be/integrations/connection-options` and an `agentConfig` body on `PUT /agents/alert/:alertId/rca`. Session routes for the Open 360 alert form. No gaia UI has merged yet, so nothing is customer-visible. Not part of the public `/v2` API, so `api.md` is unchanged. Revisit when the alert form change lands in `gaia-hermes-ws`. + * #464, #465 (galangel, ORIONIQ-1793): chat turn context as `turnContext` data. Internal. #478 and its revert #485: filter chip focus, net zero. #481, #479, #480, #482, #463: vendor and release chores. +* `OIQ-AI-service` - #520 (augment770-dev, ORIONIQ-1799): one default date and time format in answers. Prompt behavior, no route or schema change. #523: ECR image build workflow. No doc change. +* `gaia-hermes-ws` - #17196 and #17179 (Unified Dashboards, APPZ-3423 and APPZ-1937), #17191 (fake gateway for local dev). Out of OrionIQ scope. +* `oiq-resources` - no commits. + +### 2026-10-15 - daily scan (since 2026-10-14), doc changes made + +* `Artemis` - #369 (Gavriel-M, ORIONIQ-1683): new public `POST /v1/orioniq-be/agents/search`, gateway-authenticated with an API token, scoped to the token's own account, `pageSize` capped at 50. It is the first route of the **v1 public URL convention** (`/v1/orioniq-be/[/:id][/]`); the 12 existing `/v2` endpoints are frozen. Added **List agents** to `api.md`. Source of the field list: the PR body and `public.routes.ts`. Known gap in the endpoint: security-rule agents also show "Logz.io Alert" in `displayName`. + * #474, #488, #489 (RoyiSitbon): the structured RCA answer renders as a report in the invocation drawer, with stats, a pie chart and named investigators on the Analysis tab. Not documented: no verified copy for the report, and `agents-hub.md` describes the Output tab only in general terms. Revisit with the RCA v2 flag rollout. + * #487, #486: filter chip focus fix, RUM listener leak. Internal. +* `gaia-hermes-ws` - #17199, #17200 (Gavriel-M, ORIONIQ-1811): the alert and SIEM rule AI Analysis step gets a **Configure your agent** dialog (instructions, output detail, recipients) saved with the alert or rule. It retires the **Configure agent after saving** checkbox, and the hub link is now **Manage in Agents Hub**. Updated the three pages that described the old checkbox: both `configure-alerts-explore.md` twins and `manage-security-rules.md`. The dialog is behind the RCA v2 flag per the PR test plan, and the PR has no screenshots. + * #17207 (typed swagger, TypeScript bump), #17203 (Span Explorer), #17204 (Unified Dashboards legend): out of OrionIQ scope. +* `OIQ-AI-service` - #528, #522 (kevkle): RCA OIHV loop and deepagent telemetry domain. Internal runtime, no public route or schema change. +* `oiq-resources` - no commits. + +Existing PR #975 had no unresolved reviewer comments. No screenshots marked for documentation use. Assignees extended with the authors of the triggering commits. + +### 2026-10-16 - daily scan (since 2026-10-15 06:00), doc changes made + +* `Artemis` - #501 (Gavriel-M, ORIONIQ-1683): `POST /v1/orioniq-be/agents/search` now honors `sort` (first entry only; fields `name`, `type`, `active`, `createdAt`, `updatedAt`, `lastRun`; bad entry falls back to `createdAt` desc). Added the `sort` rows and example to **List agents** in `api.md`. Source: `agent-search-filters.ts` and the swagger constants. + * #492 (yotamloe, ORIONIQ-1841): agent builder takes its account from the session. Internal fix. #493 (RoyiSitbon): RCA report moved into `orion-chat`, still no verified copy. #498, #483: version packages. +* `gaia-hermes-ws` - #17217 (RoyiSitbon, ORIONIQ-1833): Open 360 drawer renders the RCA report and the onboarding survey is served by orioniq-be (`/orioniq-be/user-docs/survey`, session route). #17202, #17205, #17206, #17216 (Gavriel-M, ORIONIQ-1811, ORIONIQ-1830, ORIONIQ-1621): integrations picker and form-agnostic RCA agent setup modal, analytics events. Same RCA v2 flag as #17199 and #17200, no screenshots, not documented yet. #17211, #17212, #17214 (APPZ-3491): Swagger for other services, out of scope. +* `OIQ-AI-service` - #525, #521 (galangel): CI image tags and dev-namespace overrides. Internal. +* `oiq-resources` - #115 (Gavriel-M, ORIONIQ-1621): agent memory made configurable in marketplace templates. Still behind the `oiq-agent-docs` flag, not documented. Revisit when the flag is removed. + +Existing PR #975 had no unresolved reviewer comments. Appended to its branch. Gavriel-M, RoyiSitbon and galangel are the authors of triggering commits; vicmiletsky's commits were out of scope. + +### 2026-10-19 - daily scan (since 2026-10-18 06:00), no doc changes + +* `Artemis` - #494 (Gavriel-M, ORIONIQ-1621): agent memory now covers every agent except chat and Alert AI Analysis v1, on by default per run. Still shown only when `memoryAvailable` answers true, which needs the pod-mounted `oiq-agent-docs` flag. Not documented. Revisit when the flag is removed. +* `OIQ-AI-service` - #526 (augment770-dev, ORIONIQ-1827): Haiku 5.5 and named invocation profiles. #529 (yotamloe, ORIONIQ-1486): `@timestamp` rejected in aggregation tools. #532 (ralongit): agents may use the integration writes they hold. Internal runtime and prompt behavior, no public route or schema change. +* `oiq-resources` - #116 to #119 (ralongit, ORIONIQ-1377): fixes to the Alert Digest and Alert Tuning Report templates and the `logzio_api.md` skill (unified alert events filters, log-alert grouping by title, alert links by name). The six tuning patterns and the alert links already match the `marketplace.md` descriptions. No doc change. +* `gaia-hermes-ws` - no commits. + +Existing PR #975 had no unresolved reviewer comments and is approved. No screenshots marked for documentation use. Appended the log entry only. Assignees unchanged. + +### 2026-10-20 - daily scan (since 2026-10-19 06:00), doc changes made + +* `Artemis` - #512 (yotamloe, ORIONIQ-1858): feedback reflections are free. Price $0, no free-usage count, no AI budget check, still recorded as a $0 invocation. Removed the "$1 after 20 free" note in `create-agent.md`. + * #507 (ralongit, ORIONIQ-1850): Connect modal shows Agent permissions above How to connect and hides the auth-method tile for single-method integrations. `integrations.md` stays accurate. #495, #496 (Gavriel-M, ORIONIQ-1621): shared Memory files on an agent, still behind the memory flag, not documented. #508 (RoyiSitbon): RCA report tidy-up, still no verified copy. #503, #513, #514: internal. +* `oiq-resources` - 9a7ff36 (ralongit): `alert-tuning-report` and `scheduled-error-logs-report` moved from Summary to Detailed. Every template now ships Detailed, so `marketplace.md` says so instead of "Summary by default". +* `gaia-hermes-ws` (`master`) - #17208, #17221 (Gavriel-M, ORIONIQ-1830, 1849): the alerts list AI Analysis cell opens the RCA agent setup dialog directly. Not documented: `triggered-alerts.md` covers the triggered list, and no verified copy exists for the alert configuration list. #17209 (APPZ-3497): AI Observability drilldown, out of scope. +* `OIQ-AI-service` - #536, #527, #533 (kevkle, RoyiSitbon), #535, #534 (augment770-dev): RCA OIHV internals, model construction, smoke-test fake LLM. Internal. + +Existing PR #975 had no unresolved reviewer comments. Merged `master` into its branch (it was behind). No screenshots marked for documentation use. Assignees extended with yotamloe and ralongit. + +### 2026-10-21 - daily scan (since 2026-10-20 06:09), doc changes made + +* `gaia-hermes-ws` - #17224, #17227 (Gavriel-M, ORIONIQ-1849, ORIONIQ-1861): the **Configure your agent** dialog now has a **Data sources** section (alert accounts plus added log or metrics accounts), shows the agent's price per run with free runs left, and no longer has an output detail field. Updated the three pages that list the dialog settings: both `configure-alerts-explore.md` twins and `manage-security-rules.md`. The SIEM page does not mention data sources, since the section only renders when the form passes an alert scope. Source of truth: `RcaAgentSetupSections.tsx` and `rca-agent-setup-price.util.ts`. + * #17229 (internal legacy dashboard endpoints for support tools), #17228, #17226, #17225, #17215, #17210, #17219: out of OrionIQ scope. +* `oiq-resources` - 8d07ead (ralongit, ORIONIQ-1434): the **Exception Analysis** template ships to `main` (category Incident, weekly by default, requires the Exceptions capability from Logz.io Support). Added a row to the Available templates table in `marketplace.md`. The 2026-10-20 revert and reapply of the same merge is net zero. +* `Artemis` - #504 (Gavriel-M, ORIONIQ-1849): the alert RCA session route accepts data sources. Session route, not part of the public `/v2` API. #497 (Gavriel-M) and #530: memory file usage, still behind the memory flag. #522 (RoyiSitbon): RCA report fixes, still no verified copy. #517, #510, #519, #499: UI colour, avatar, vendor and version chores. +* `OIQ-AI-service` - #544, #543 (kevkle, RoyiSitbon): the OIHV RCA answer contract moves to 5.0.0 with customer status wording, an App-AI contract and not a public OrionIQ route. #524 (yotamloe): memory doc audit events to the gaia audit indexer, off unless configured. #530: kb_delete guard. No doc change. + +Existing PR #975 had no unresolved reviewer comments. Merged `master` into its branch. No screenshots marked for documentation use. Assignees already include the authors of the triggering commits. + +### 2026-10-23 - daily scan (since 2026-10-22 06:00), doc changes made + +* `oiq-resources` - #100 (ralongit, ORIONIQ-1450): the **Log Patterns Analysis** template ships to `main` (category Alerting, weekly by default, daily by editing the message's cadence line). Added a row to the Available templates table in `marketplace.md`. Follow-up commits (#147 and others) only tune the report shape. + * ORIONIQ-1894 (ralongit): a SigmaHQ keyless integration and a CVE-to-Cloud-SIEM-rule procedure in the `logzio_security_api` skill, with `OIQ-AI-service` #591 adding the `convert_sigma_rule` tool. It is chat and agent behavior on Cloud SIEM tenants with no UI or public route, and OrionIQ for SIEM is still undocumented. Not documented. Revisit with the OrionIQ chat page. +* `Artemis` - #543 (ralongit): Log Patterns Analysis price, label and tag colour. Prices are per-environment config, not documented. #561 (RoyiSitbon): `Custom3` "POC" agent type, free per invocation, behind `oiq-hermes-agent-types`. Not documented while flagged. #556: service-to-service route without a session, internal. #557, #551, #549, #550: UI and body-limit chores. +* `OIQ-AI-service` - #464 (`get_log_patterns` tool, no route), #592 (kevkle, RCA OIHV eligibility), #569 (research sim). Internal. +* `gaia-hermes-ws` - #17235, #17218 (TypeScript and Node upgrades), #17197 (Unified Dashboards trace drilldown). Out of OrionIQ scope. + +Existing PR #975 had no unresolved reviewer comments. Merged `master` into its branch. No screenshots marked for documentation use. Assignees already include the authors of the triggering commits. + +### 2026-10-26 + +* `Artemis` - #559, #547, #565, #530, #529 (Gavriel-M, ORIONIQ-1876, 1869, 1877, 1868, 1870): marketplace card Data and Trigger tags, per-account template price, template-locked "All settings" form and required Triage runbook, Deployment trigger no longer offered, whole-hour schedules and local weekly day, 191-character name and description limit. Updated `marketplace.md` and `create-agent.md`. The create-agent and marketplace routes are not in the public `api.md`, so their new 400/404/503 shapes are not documented. #528, #552, #553, #571: design system and base image chores. +* `oiq-resources` - #143, #145 (ralongit): agent skill text for CVE research and SIEM rule guards. No UI or public route. Not documented. +* `OIQ-AI-service`, `gaia-hermes-ws` - no commits in the window. +* PR #975 had no unresolved comments. Commits for this run were pushed to its existing branch `claude/gracious-thompson-n77ck0`, not the session branch. + +## Run notes + +* 2026-10-27: The in-app API reference (`api-endpoints.ts`) now lists lessons and agents search. `api.md` mirrors both. Schedule validation and `schedule.tz` (ORIONIQ-1880) are documented in one line on the Schedule row of `create-agent.md`, since `POST` and `PUT /orioniq-be/agents` are not on the public API page. + +## Run notes + +* **2026-10-29:** Artemis #570 deleted the Marketplace preview and activation dialog ("All settings" included) and replaced it with the guided Review, Set up, and Done flow. Its notes live in `apps/orioniq/CLAUDE.md` under "Guided activation"; the file is about 250 KB, so fetch it to disk and read that section only. Artemis #575 made `POST /v2/orioniq-be/ai-agent/:agentId` return `404` for an agent the caller's account can't access. +* The existing agent PR is reused until it merges; its description is rewritten on every run. diff --git a/docs/open360/alerts/configure-alerts-explore.md b/docs/open360/alerts/configure-alerts-explore.md index bc13946f..b33aaabb 100644 --- a/docs/open360/alerts/configure-alerts-explore.md +++ b/docs/open360/alerts/configure-alerts-explore.md @@ -216,7 +216,9 @@ Once triggered, the AI Agent will analyze related logs, metrics, and patterns. A #### Configure the agent -Enabling AI Agent Analysis creates an OrionIQ agent for the alert. Select **Configure agent after saving** to open it right after you save, or manage it later from the Agents Hub — the alert form links to it with **Manage in Agent Hub**. +Enabling AI Agent Analysis creates an OrionIQ agent for the alert when you save it. Select **Configure your agent** to set the agent's instructions, data sources, integrations, and recipients. **Data sources** lists the accounts the alert covers, and you can add log or metrics accounts for the agent to investigate. The dialog also shows the agent's price per run, with any free runs left. **Apply** adds your changes to the alert form, and they are saved with the alert. Turning AI Agent Analysis off and saving removes the agent and its settings. + +For full agent configuration, use **Manage in Agents Hub**, which opens the agent in the Agents Hub. The agent is editable like any other, so beyond the settings on this page you can: diff --git a/docs/user-guide/cloud-siem/security-rules/manage-security-rules.md b/docs/user-guide/cloud-siem/security-rules/manage-security-rules.md index 0b164538..9c7eed83 100644 --- a/docs/user-guide/cloud-siem/security-rules/manage-security-rules.md +++ b/docs/user-guide/cloud-siem/security-rules/manage-security-rules.md @@ -176,7 +176,9 @@ Every run is stored in the agent's invocation history, where you can read the fu #### Configure the agent -Turning the toggle on creates an OrionIQ agent for the rule, and you can update it at any time. Select **Configure agent after saving** to open it right after you save, or manage it later from the Agents Hub — the rule form links to it with **Manage in Agent Hub**. +Turning the toggle on creates an OrionIQ agent for the rule when you save it. Select **Configure your agent** to set the agent's instructions, integrations, and recipients. The dialog also shows the agent's price per run, with any free runs left. **Apply** adds your changes to the rule form, and they are saved with the rule. Turning the toggle off and saving removes the agent and its settings. The button is disabled on protected rules and for read-only users. + +For full agent configuration, use **Manage in Agents Hub**, which opens the agent in the Agents Hub. The agent is editable like any other, so beyond the settings above you can: diff --git a/docs/user-guide/explore/explore-log-alerts/configure-alerts-explore.md b/docs/user-guide/explore/explore-log-alerts/configure-alerts-explore.md index 03e95e69..19f34c8e 100644 --- a/docs/user-guide/explore/explore-log-alerts/configure-alerts-explore.md +++ b/docs/user-guide/explore/explore-log-alerts/configure-alerts-explore.md @@ -189,7 +189,9 @@ AI Agent Analysis runs **once every hour**. #### Configure the agent -Enabling AI Agent Analysis creates an OrionIQ agent for the alert. Select **Configure agent after saving** to open it right after you save, or manage it later from the Agents Hub — the alert form links to it with **Manage in Agent Hub**. +Enabling AI Agent Analysis creates an OrionIQ agent for the alert when you save it. Select **Configure your agent** to set the agent's instructions, data sources, integrations, and recipients. **Data sources** lists the accounts the alert covers, and you can add log or metrics accounts for the agent to investigate. The dialog also shows the agent's price per run, with any free runs left. **Apply** adds your changes to the alert form, and they are saved with the alert. Turning AI Agent Analysis off and saving removes the agent and its settings. + +For full agent configuration, use **Manage in Agents Hub**, which opens the agent in the Agents Hub. The agent is editable like any other, so beyond the settings on this page you can: diff --git a/docs/user-guide/orioniq/api.md b/docs/user-guide/orioniq/api.md index 958801da..e8616593 100644 --- a/docs/user-guide/orioniq/api.md +++ b/docs/user-guide/orioniq/api.md @@ -2,13 +2,13 @@ sidebar_position: 9 title: OrionIQ API image: https://dytvr9ot2sszz.cloudfront.net/logz-docs/social-assets/docs-social.jpg -description: Trigger OrionIQ agents, poll for results, send follow-ups, and submit feedback using the OrionIQ API. -keywords: [OrionIQ, API, agents, trigger agent, agent run, feedback, api token, automation] +description: List agents, trigger OrionIQ agents, poll for results, send follow-ups, and submit feedback using the OrionIQ API. +keywords: [OrionIQ, API, agents, list agents, agent ID, trigger agent, agent run, feedback, api token, automation] --- Agents configured with the **API** trigger run on demand when you call the OrionIQ API. Use it to start a run from a CI pipeline, an incident workflow, or any external system, then poll for the result. -To get an agent's ID and a ready-to-copy request for each endpoint, open the agent's actions menu in the [Agents Hub](/docs/user-guide/orioniq/agents-hub/) and select **API References**. +To get an agent's ID and a ready-to-copy request for each endpoint, open the agent's actions menu in the [Agents Hub](/docs/user-guide/orioniq/agents-hub/) and select **API References**. To look agents up with the API instead, use [List agents](#list-agents). ## Authentication @@ -34,6 +34,86 @@ If AI features are disabled for the account, [Run an agent](#run-an-agent) and [ If the account has reached its configured AI usage cap, [Run an agent](#run-an-agent) and [Send a follow-up](#send-a-follow-up) return `429` (`errorCode: "CAP_EXCEEDED"`). See [OrionIQ Settings → Capping](/docs/user-guide/orioniq/settings/#capping) for usage and budget limits. ::: +## List agents + +``` +POST /v1/orioniq-be/agents/search +``` + +Returns the agents in the token's account, so you can find an agent ID without opening the Agents Hub. Sub-account agents are not included. Listing starts no AI work, so it also works when AI features are disabled. + +### Sample request + +```shell +curl -X POST -L \ + https://<>/v1/orioniq-be/agents/search \ + -H 'Content-Type: application/json' \ + -H 'X-API-TOKEN: <>' \ + -d '{ + "filter": { + "searchTerm": "checkout", + "active": true + }, + "sort": [ + { + "field": "lastRun", + "descending": true + } + ], + "pagination": { + "pageNumber": 1, + "pageSize": 20 + } + }' +``` + +All fields are optional. A filter value the API cannot use is ignored. + +| Field | Description | +|---|---| +| `filter.searchTerm` | Returns agents whose title contains this text. | +| `filter.type` | Filters by agent type. | +| `filter.trigger` | Filters by trigger. An unknown value returns no results. | +| `filter.active` | `true` for enabled agents, `false` for disabled ones. | +| `filter.createdBy` | Filters by creator. | +| `sort` | A list where only the first entry is used. Each entry takes a `field` and an optional `descending` flag (default `false`). | +| `sort[].field` | One of `name`, `type`, `active`, `createdAt`, `updatedAt`, or `lastRun`. | +| `pagination.pageNumber` | The page to return. | +| `pagination.pageSize` | Results per page. Defaults to 50 and is capped at 50. | + +Results are ordered by creation time, newest first, unless you set `sort`. An unusable `sort` entry falls back to the default order. In ascending order, agents that never ran come first when sorting by `lastRun`. + +### Response + +```json +{ + "total": 1, + "results": [ + { + "id": "", + "name": "", + "displayName": "Checkout Latency Review", + "description": "Reviews latency on the checkout service.", + "type": "", + "trigger": "", + "active": true, + "isSystemAgent": false, + "createdAt": "2026-10-01T08:00:00Z", + "updatedAt": "2026-10-10T09:30:00Z", + "lastRun": "2026-10-14T06:00:00Z" + } + ], + "pagination": { + "pageNumber": 1, + "pageSize": 20 + } +} +``` + +`total` is the number of matching agents across all pages. A page past the end returns an empty `results` list. Use `displayName` as the agent's title. Each `id` works as `<>` in the other endpoints. + +A request authenticated with a session or share token instead of an API token returns `401`. + ## Run an agent ``` @@ -66,7 +146,7 @@ curl -X POST -L \ | `context.message` | The prompt for this run. | | `context.additionalContext` | Optional free-text context to pass to the agent. | | `context.timerange` | Optional `startTime` and `endTime` bounding the data the agent analyzes. | -| `context.security` | Optional list of accounts to query, each with an optional `filter` of `field` and `value`. | +| `context.security` | The accounts the run reads. Each entry takes a `requestedAccountId`, a `type` of `log` or `metric`, and an optional `filter` of `field` and `value`. Always send at least one entry. Without it, the run falls back to the accounts saved on the agent, and a Scheduled agent, or one with none saved, fails with `422`. An account the API token can't read is dropped, and a run with none left is rejected with `403`. | | `integrations` | Optional list of integration connections the run may use. | Fields you send override the matching fields in the agent's saved **Payload (JSON)**. @@ -80,7 +160,7 @@ Fields you send override the matching fields in the agent's saved **Payload (JSO } ``` -A disabled agent returns `404`, unless its trigger type is Alert. When OrionIQ is temporarily shut down for maintenance, the endpoint returns `503`. +An agent that doesn't exist, or that your account can't access, returns `404`. A disabled agent also returns `404`, unless its trigger type is Alert. When OrionIQ is temporarily shut down for maintenance, the endpoint returns `503`. ## Get run status @@ -214,3 +294,65 @@ Returns the feedback record for a run, in the same shape as a single entry in th :::note Agents don't have to be reachable over the API to be rated. Runs started by a Scheduled, Deployment, or Alert trigger can be rated from the Agents Hub, and the same feedback endpoints apply to them. ::: + +## List lessons + +``` +GET /v2/ai-agent/<>/lessons +``` + +Returns what the agent has learned from feedback. Active lessons are applied to the agent's runs while its Learning setting is on. + +### Sample request + +```shell +curl -X GET -L \ + https://<>/v2/ai-agent/<>/lessons \ + -H 'X-API-TOKEN: <>' +``` + +### Response + +```json +{ + "lessons": [ + { + "lessonId": "", + "status": "active", + "situation": "", + "rule": "", + "whyNote": "", + "feedbackRef": ":", + "createdAt": "2026-10-14T06:00:00Z", + "lastLoaded": "2026-10-15T06:00:00Z", + "isUpdated": false + } + ] +} +``` + +`status` is `active` or `disabled`. Apart from `lessonId` and `isUpdated`, every field is optional and can be missing. + +## Set lesson status + +``` +PUT /v2/ai-agent/<>/lessons//status +``` + +Turns a lesson on or off. A disabled lesson is kept but no longer applied to the agent's runs. + +### Sample request + +```shell +curl -X PUT -L \ + https://<>/v2/ai-agent/<>/lessons//status \ + -H 'Content-Type: application/json' \ + -H 'X-API-TOKEN: <>' \ + -d '{ + "enabled": false + }' +``` + +### Response + +The updated lesson, in the same shape as an entry in the List lessons response, with `status` set to `disabled` or `active`. diff --git a/docs/user-guide/orioniq/create-agent.md b/docs/user-guide/orioniq/create-agent.md index f47c571d..35285f71 100644 --- a/docs/user-guide/orioniq/create-agent.md +++ b/docs/user-guide/orioniq/create-agent.md @@ -40,8 +40,8 @@ The configuration is a series of sections. Work through them in order. | Field | Description | |---|---| -| **Agent Name** | A descriptive name for your agent. | -| **Description** | A brief explanation of what the agent does. | +| **Agent Name** | A descriptive name for your agent, up to 191 characters. It can't start with `logz-` or `orioniq-general`. | +| **Description** | A brief explanation of what the agent does, up to 191 characters. | | **Active** | Enable or disable the agent. When disabled, it won't run regardless of its trigger. For an alert-linked agent this is managed from the alert definition. | ### Agent Definition @@ -70,7 +70,7 @@ Structured output schemas must be flat: properties can be primitives or arrays o |---|---| | **Type** | The agent type. Determines how the agent is priced and which data it can reach. | | **Trigger** | How the agent runs — see below. | -| **Schedule** | For a Scheduled trigger, the interval the agent runs on. | +| **Schedule** | For a Scheduled trigger, the interval the agent runs on. An hourly interval must be a whole number of hours. The agent saves the time zone you pick (**Local** uses your browser's time zone, or choose **UTC**), and runs at the hour and weekly day you set in that zone, following daylight saving changes. An agent saved before time zones were stored runs on UTC and shows its hour converted to your local time. When the agent's time zone differs from yours, the schedule summary and the marketplace plan name it, for example "Weekly on Monday at 09:00 (America/New_York)". | Choose how the agent will run by selecting a trigger type: @@ -78,9 +78,10 @@ Choose how the agent will run by selecting a trigger type: |---|---| | **API** | The agent runs when called via the [OrionIQ API](/docs/user-guide/orioniq/api/). Use this for on-demand or externally triggered invocations. | | **Scheduled** | The agent runs automatically at defined intervals (for example, every 3 hours or once a day). | -| **Deployment** | The agent runs automatically when a deployment event is detected. | | **Alert** | The agent runs automatically when a Logz.io alert is triggered. | +The Deployment trigger is no longer offered. An agent already set to it still shows it, but nothing starts it, so switch it to another trigger. + ### Daily Invocation Cap Each agent invocation incurs a cost. Set the maximum number of invocations per day to control your usage budget. Leave it empty for unlimited invocations, or set it to 0 to block the agent completely. @@ -95,7 +96,7 @@ Pick the observability platform and accounts this agent can query. Toggle the sc With **Logs + Metrics (deep)**, a coordinating agent plans the investigation and assigns each part to specialized logs, metrics, and integration sub-agents, then combines their findings. It decides each next step from what the previous step returned rather than following a fixed sequence. -Data Sources is available for every trigger type. Which scopes you have to fill in follows the **Agent tools** you chose above: a scheduled agent declaring a logs tool set needs a logs data source, and it won't save until every declared scope has one. For API, Alert, and Deployment agents, picking a data source is optional. +Data Sources is available for every trigger type. Which scopes you have to fill in follows the **Agent tools** you chose above: a scheduled agent declaring a logs tool set needs a logs data source, and it won't save until every declared scope has one. For API and Alert agents, picking a data source is optional. When you create an alert-linked AI analysis agent, it starts with the accounts named in the alert, and you can edit them here. If the alert queries all accounts, the agent follows the alert instead and picks up new sub-accounts. Later changes to the alert don't overwrite the accounts you saved. If you remove every account, the agent falls back to the alert's accounts. @@ -125,7 +126,7 @@ An agent can hold up to 20 active lessons at a time. As that limit gets close, a Each lesson has its own **On/Off** switch. Turning a lesson off removes it from future runs without deleting it, and turning it back on restores it, so you can roll back what the agent has learned one lesson at a time. :::note -Writing a note is billed once it's accepted for review, whether or not it ends up teaching the agent anything: the first 20 reflections per account are free (all-time), then $1 each. +Writing a note is free. Each accepted note is still recorded as an invocation, at no cost, and it does not count against your AI budget. ::: ## Finalize and create diff --git a/docs/user-guide/orioniq/marketplace.md b/docs/user-guide/orioniq/marketplace.md index eb754d5f..f5c3c6bd 100644 --- a/docs/user-guide/orioniq/marketplace.md +++ b/docs/user-guide/orioniq/marketplace.md @@ -25,6 +25,8 @@ Agent templates are organized into the following categories: | **Alerting** | Agents that filter and prioritize alerts to surface high-confidence, high-impact events. | | **Performance** | Agents that identify early degradation patterns in latency, error rates, and throughput. | +Each card shows two tags: **Data** (Logs, Metrics, or Logs + Metrics) and **Trigger** (Scheduled, On demand, or Per alert). A card whose template sets neither shows no tags. + Use the search bar at the top of the page to find specific agent templates, or click a category tab to filter the list. ## Available templates @@ -34,9 +36,11 @@ Use the search bar at the top of the page to find specific agent templates, or c | **Alert AI Analysis** | Incident | When an alert fires | Correlates error logs, related metric anomalies, recent deployments, and the affected request paths, then summarizes the root cause with recommended remediation steps. This is the agent behind [AI Agent Analysis](/docs/open360/observability/ai-agent-analysis/). | | **Root Cause Analysis** | Incident | On demand (API) | Reconstructs the incident timeline, correlates logs, metrics, and traces, inspects recent deployments and configuration changes, and produces a ranked set of probable root causes with supporting evidence and remediation recommendations. | | **Incident Triage** | Incident | On demand (API) | Loads your runbook, walks through its diagnostic steps against live logs and metrics, evaluates the findings against the runbook's decision points, applies the prescribed remediation guidance, and produces a prioritized list of next steps for the responder. | +| **Exception Analysis** | Incident | Weekly | Reads the exceptions Logz.io already clusters for your account and groups variants of the same fault into families. Each family is sorted as new, spiking, ongoing, resolved, or muted, with occurrence counts, a trend, and a link to the logs. Daily runs open with a ranked list of what needs attention today. Exceptions you ask it to ignore stay muted, with your reason, until you ask for them back. Requires the Exceptions capability on the account, which Logz.io Support enables. | | **Alert Digest** | Alerting | Weekly | Summarizes what fired, what resolved, and how long alerts stayed triggered, with a period-over-period comparison, top offenders, first-time alerts, and incident-like episodes. | | **Alert Tuning Report** | Alerting | Weekly | Analyzes triggered-alert history across log and metric alerts and produces a ranked list of concrete tuning recommendations: flapping alerts, fast self-resolvers, severity miscalibration, alerts that always fire together, dead alerts, and services whose alerts went quiet. Each recommendation cites the current value, the proposed value, the supporting numbers, and a link to the alert definition. | | **Error Logs Analysis** | Alerting | Daily | Breaks down errors and warnings by application, compares them with the previous period, and highlights spikes. | +| **Log Patterns Analysis** | Alerting | Weekly | Reads the patterns Logz.io already groups your logs into, for this period and the one before, at any log level. It reports patterns that are new, growing against their own earlier count, steady, or gone. Each item names the pattern's level and service and links to its logs, and the report closes with the share of logs the patterns matched. Exception-tagged logs are left to Exception Analysis. For a daily report, set the schedule to daily and change the opening "Cadence: weekly" in the message to "Cadence: daily". | | **Log Distribution Monitor** | Performance | Daily | Analyzes log volume distribution and trends across services to detect anomalies, identify cost drivers, and keep logging healthy. | ### How Incident Triage works @@ -49,30 +53,70 @@ It then checks live telemetry and reports the incident as resolved, contained, a ## Activate an agent template -To activate an agent template, click **View details** on its card, then click **Activate**. The preview turns into a short setup dialog, and the agent is created switched on. +Click a template card to open a three-step dialog: **Review**, **Set up**, and **Done**. The agent is created switched on when you finish **Set up**. + +### Review + +Review shows what the agent does before you commit: when it runs, what it produces, what data it needs, and its price per run. If the price can't be loaded, Review says so, and you can activate once it loads. + +Click **Set up agent** to continue. + +### Set up -The template decides which sections the dialog shows. A section appears only when the template lets you change it. Anything hidden keeps the template's value. +The template decides which fields appear. A field shows only when the template lets you change it. Anything hidden keeps the template's value. -| Section | What you set | +| Field | What you set | |---|---| -| **Trigger** | The trigger type and, for a scheduled agent, the schedule. | -| **Runbook** | The instructions for agents triggered by an API call, an alert, or a deployment. A scheduled agent shows its context message and run frequency instead. | -| **Output detail** | **Summary** by default, unless the template sets a level. | -| **Data sources** | The accounts the agent reads from. For an agent that reads logs, the account you are on is selected by default. | +| **Name** | Shown only when you already have agents from this template. It is prefilled, for example "Alert Digest 2". | +| **Runbook** | Required when the template needs one, as for Incident Triage. Shown for agents that run on demand. | +| **Data sources** | The accounts and connections the agent reads logs and metrics from. For an agent that reads logs, the account you are on is selected by default. | +| **Schedule** | For a scheduled agent: how often it repeats, the day, the hour, and the time zone. The next run is shown in the schedule's own zone. | +| **Send results to** | Who gets notified of the agent's results. | | **Integrations** | The integrations the agent can use. | -| **Notification recipients** | Who gets notified of the agent's results. | +| **Instructions** | The context message a scheduled agent runs with. | + +Data sources, Send results to, and Integrations open in a picker. Each selected item has a remove button. + +The side panel summarizes the agent, its expected runs, and its cost. On narrow screens the summary moves into the main column. + +Billing choices: + +* **After the free runs**: **Turn off** (the default) or **Keep running**, billed per run. If you can't see pricing, the choice is not offered. +* **Daily run limit**: For agents that run on demand, set the maximum runs a day. It starts at 5. Clear the box for no limit. + +Click **Activate agent**. If required fields are missing, the dialog lists how many need attention and moves you to the first one. If you close the dialog after changing the setup, OrionIQ asks before it discards your changes. + +Learning is off for agents activated from the Marketplace. You can turn it on later in the agent's **Agent details** form. See [Learning](/docs/user-guide/orioniq/create-agent/). + +### Done + +Done confirms the agent is active and shows what happens next: + +* **First run**: the next scheduled time, "When you start it", or "When an alert fires". +* **Free runs**: how many are left. +* **After free runs**: whether the agent turns off or keeps running at your price per run. +* **Daily limit**: shown for agents that run on demand. +* **Results**: the recipients, or the run history in Agents Hub. + +Click **Run a test** to start the agent once with sample input. It uses one of the free runs, or is billed at the price per run when the template has none. Results appear in the agent's run history in [Agents Hub](/docs/user-guide/orioniq/agents-hub/). If the test can't start because of a daily limit or budget cap, Done says which one. + +Done also offers one optional follow-up. A scheduled agent with no recipients offers **Add recipients**. An agent that runs on demand offers **Connect an alert**. + +The **What you set up** panel recaps your choices. To change them later, open the agent in Agents Hub. + +Click **Open in Agents Hub** to see the new agent, or **Done** to close the dialog. -Data sources, Integrations, and Notification recipients appear as one-line summaries that expand in place. If something required is missing, such as a data source or a reconnected integration, the row opens so you can fix it. +You can activate a template more than once. Once agents exist for a template, its card shows the number of active agents. Click it to open the Agents Hub filtered to those agents. To switch an agent off, use the Agents Hub. -Learning is off for agents activated from the Marketplace, because it is billed separately. You can turn it on later in the agent's **Agent details** form. See [Learning](/docs/user-guide/orioniq/create-agent/). +## Free trial -Click **All settings** to move your draft into the full agent form in the side panel, with everything you entered so far. Click **Show details** or **Hide details** to switch between the template description and the setup form. +Every agent you activate from the Marketplace starts with a free trial. The template card, the Review and Set up steps, and the Done step all show how many free runs the agent has. -If you close the dialog after changing the setup, OrionIQ asks before it discards your changes. +When the free runs are used, the agent switches off automatically and nothing is charged. In the [Agents Hub](/docs/user-guide/orioniq/agents-hub/), the **Cost** column shows the runs left, and an agent whose trial is over is marked **Trial ended**. Nothing runs or is charged until you turn it back on, and turning it on again asks you to confirm that each run is billed. -After you click **Activate agent**, a confirmation shows how the agent runs. Click **Open in Agents Hub** to see the new agent in the [Agents Hub](/docs/user-guide/orioniq/agents-hub/), filtered to the template's agent type. +Template cards and the Review step show your account's own price per run. If the price can't be loaded, the price is left out and the free trial is still offered. -You can activate a template more than once. Once agents exist for a template, its card and preview show the number of active agents. Click it to open the Agents Hub filtered to those agents. To switch an agent off, use the Agents Hub. +If you can see pricing, Set up and the agent form also offer **Keep running** after the free runs. Select it to let the agent keep running, billed per run, once the trial ends. If a template you're interested in is not yet available, click **Add to Wish List** to signal your interest. This helps Logz.io prioritize which templates to build next.