From 3bf37a08f613576d2bace6c572eebeaefe77a135 Mon Sep 17 00:00:00 2001 From: Claude Date: Wed, 14 Oct 2026 06:11:38 +0000 Subject: [PATCH 01/11] docs(orioniq): document the Marketplace free trial Co-Authored-By: Claude Sonnet 5.5 Claude-Session: https://claude.ai/code/session_016UWPXKT37jGkkeqQ7E4WuP --- agents.md | 10 ++++++++++ docs/user-guide/orioniq/marketplace.md | 8 ++++++++ 2 files changed, 18 insertions(+) diff --git a/agents.md b/agents.md index 6a37b9d6..81d972e0 100644 --- a/agents.md +++ b/agents.md @@ -711,3 +711,13 @@ No unresolved reviewer comments on the PR. No screenshots marked for documentati * `OIQ-AI-service`, `oiq-resources` - no commits. No unresolved reviewer comments on the PR. No screenshots marked for documentation use. Assignees unchanged. + +### 2026-10-14 - daily scan (since 2026-10-13 06:09), doc changes made + +* `Artemis` - #476 (Gavriel-M, ORIONIQ-1823): the `oiq-marketplace-free-trial` flag is removed, so the free trial is on for every account. Closes the open item from 2026-10-12. Added a **Free trial** section to `marketplace.md`. Source of wording: `AgentCommon/constants.ts` (`FREE_TRIAL_MESSAGES`) and `free-trial.util.ts`. The free run count and per-run price are template and Consul data, so the section does not quote them. + * #438 (yotamloe, ORIONIQ-1433, ORIONIQ-1772): agent memory, with a Memory **Agent docs** tab and a "Remember between runs" toggle in the agent editor. Not documented. Real memory still needs the per-account `oiq-agent-docs` flag and ai-service 3.12.0 in the region, so it is a staged rollout. Revisit when the flag is removed. `memory.md` stays accurate for account and user documents. + * #473 and #475 (Gavriel-M, ORIONIQ-1811): `GET /orioniq-be/integrations/connection-options` and an `agentConfig` body on `PUT /agents/alert/:alertId/rca`. Session routes for the Open 360 alert form. No gaia UI has merged yet, so nothing is customer-visible. Not part of the public `/v2` API, so `api.md` is unchanged. Revisit when the alert form change lands in `gaia-hermes-ws`. + * #464, #465 (galangel, ORIONIQ-1793): chat turn context as `turnContext` data. Internal. #478 and its revert #485: filter chip focus, net zero. #481, #479, #480, #482, #463: vendor and release chores. +* `OIQ-AI-service` - #520 (augment770-dev, ORIONIQ-1799): one default date and time format in answers. Prompt behavior, no route or schema change. #523: ECR image build workflow. No doc change. +* `gaia-hermes-ws` - #17196 and #17179 (Unified Dashboards, APPZ-3423 and APPZ-1937), #17191 (fake gateway for local dev). Out of OrionIQ scope. +* `oiq-resources` - no commits. diff --git a/docs/user-guide/orioniq/marketplace.md b/docs/user-guide/orioniq/marketplace.md index 209e86c8..456a4f58 100644 --- a/docs/user-guide/orioniq/marketplace.md +++ b/docs/user-guide/orioniq/marketplace.md @@ -54,6 +54,14 @@ After you click **Activate agent**, a confirmation shows how the agent runs. Cli You can activate a template more than once. Once agents exist for a template, its card and preview show the number of active agents. Click it to open the Agents Hub filtered to those agents. To switch an agent off, use the Agents Hub. +## Free trial + +Every agent you activate from the Marketplace starts with a free trial. The template card, the preview, the activation dialog, and the confirmation after you activate all show how many free runs the agent has. + +When the free runs are used, the agent switches off automatically and nothing is charged. In the [Agents Hub](/docs/user-guide/orioniq/agents-hub/), the **Cost** column shows the runs left, and an agent whose trial is over is marked **Trial ended**. Nothing runs or is charged until you turn it back on, and turning it on again asks you to confirm that each run is billed. + +If you can see pricing, the activation dialog and the agent form also offer **Keep running after the free runs**. Select it to let the agent keep running, billed per run, once the trial ends. + If a template you're interested in is not yet available, click **Add to Wish List** to signal your interest. This helps Logz.io prioritize which templates to build next. You can also click **+ Create New Agent** in the top right corner to build a custom agent from scratch. From b8d7e5ad5d51a778f22e504bcd75d41562ededa3 Mon Sep 17 00:00:00 2001 From: Claude Date: Thu, 15 Oct 2026 06:10:38 +0000 Subject: [PATCH 02/11] docs(orioniq): document the public agent list and the alert Configure your agent dialog Co-Authored-By: Claude Sonnet 5.5 Claude-Session: https://claude.ai/code/session_01HbYKgprhBMHd8BA3bUMtdg --- agents.md | 12 +++ .../alerts/configure-alerts-explore.md | 4 +- .../security-rules/manage-security-rules.md | 4 +- .../configure-alerts-explore.md | 4 +- docs/user-guide/orioniq/api.md | 78 ++++++++++++++++++- 5 files changed, 96 insertions(+), 6 deletions(-) diff --git a/agents.md b/agents.md index 81d972e0..6dbb383b 100644 --- a/agents.md +++ b/agents.md @@ -721,3 +721,15 @@ No unresolved reviewer comments on the PR. No screenshots marked for documentati * `OIQ-AI-service` - #520 (augment770-dev, ORIONIQ-1799): one default date and time format in answers. Prompt behavior, no route or schema change. #523: ECR image build workflow. No doc change. * `gaia-hermes-ws` - #17196 and #17179 (Unified Dashboards, APPZ-3423 and APPZ-1937), #17191 (fake gateway for local dev). Out of OrionIQ scope. * `oiq-resources` - no commits. + +### 2026-10-15 - daily scan (since 2026-10-14), doc changes made + +* `Artemis` - #369 (Gavriel-M, ORIONIQ-1683): new public `POST /v1/orioniq-be/agents/search`, gateway-authenticated with an API token, scoped to the token's own account, `pageSize` capped at 50. It is the first route of the **v1 public URL convention** (`/v1/orioniq-be/[/:id][/]`); the 12 existing `/v2` endpoints are frozen. Added **List agents** to `api.md`. Source of the field list: the PR body and `public.routes.ts`. Known gap in the endpoint: security-rule agents also show "Logz.io Alert" in `displayName`. + * #474, #488, #489 (RoyiSitbon): the structured RCA answer renders as a report in the invocation drawer, with stats, a pie chart and named investigators on the Analysis tab. Not documented: no verified copy for the report, and `agents-hub.md` describes the Output tab only in general terms. Revisit with the RCA v2 flag rollout. + * #487, #486: filter chip focus fix, RUM listener leak. Internal. +* `gaia-hermes-ws` - #17199, #17200 (Gavriel-M, ORIONIQ-1811): the alert and SIEM rule AI Analysis step gets a **Configure your agent** dialog (instructions, output detail, recipients) saved with the alert or rule. It retires the **Configure agent after saving** checkbox, and the hub link is now **Manage in Agents Hub**. Updated the three pages that described the old checkbox: both `configure-alerts-explore.md` twins and `manage-security-rules.md`. The dialog is behind the RCA v2 flag per the PR test plan, and the PR has no screenshots. + * #17207 (typed swagger, TypeScript bump), #17203 (Span Explorer), #17204 (Unified Dashboards legend): out of OrionIQ scope. +* `OIQ-AI-service` - #528, #522 (kevkle): RCA OIHV loop and deepagent telemetry domain. Internal runtime, no public route or schema change. +* `oiq-resources` - no commits. + +Existing PR #975 had no unresolved reviewer comments. No screenshots marked for documentation use. Assignees extended with the authors of the triggering commits. diff --git a/docs/open360/alerts/configure-alerts-explore.md b/docs/open360/alerts/configure-alerts-explore.md index 638ed180..93c399aa 100644 --- a/docs/open360/alerts/configure-alerts-explore.md +++ b/docs/open360/alerts/configure-alerts-explore.md @@ -220,7 +220,9 @@ AI Agent Analysis runs **once every hour**. #### Configure the agent -Enabling AI Agent Analysis creates an OrionIQ agent for the alert. Select **Configure agent after saving** to open it right after you save, or manage it later from the Agents Hub — the alert form links to it with **Manage in Agent Hub**. +Enabling AI Agent Analysis creates an OrionIQ agent for the alert when you save it. Select **Configure your agent** to set the agent's instructions, output detail (Summary or Detailed), and recipients. **Apply** adds your changes to the alert form, and they are saved with the alert. Turning AI Agent Analysis off and saving removes the agent and its settings. + +For full agent configuration, use **Manage in Agents Hub**, which opens the agent in the Agents Hub. The agent is editable like any other, so beyond the settings on this page you can: diff --git a/docs/user-guide/cloud-siem/security-rules/manage-security-rules.md b/docs/user-guide/cloud-siem/security-rules/manage-security-rules.md index 0b164538..ed1a0a0f 100644 --- a/docs/user-guide/cloud-siem/security-rules/manage-security-rules.md +++ b/docs/user-guide/cloud-siem/security-rules/manage-security-rules.md @@ -176,7 +176,9 @@ Every run is stored in the agent's invocation history, where you can read the fu #### Configure the agent -Turning the toggle on creates an OrionIQ agent for the rule, and you can update it at any time. Select **Configure agent after saving** to open it right after you save, or manage it later from the Agents Hub — the rule form links to it with **Manage in Agent Hub**. +Turning the toggle on creates an OrionIQ agent for the rule when you save it. Select **Configure your agent** to set the agent's instructions, output detail (Summary or Detailed), and recipients. **Apply** adds your changes to the rule form, and they are saved with the rule. Turning the toggle off and saving removes the agent and its settings. The button is disabled on protected rules and for read-only users. + +For full agent configuration, use **Manage in Agents Hub**, which opens the agent in the Agents Hub. The agent is editable like any other, so beyond the settings above you can: diff --git a/docs/user-guide/explore/explore-log-alerts/configure-alerts-explore.md b/docs/user-guide/explore/explore-log-alerts/configure-alerts-explore.md index 03e95e69..c32de99e 100644 --- a/docs/user-guide/explore/explore-log-alerts/configure-alerts-explore.md +++ b/docs/user-guide/explore/explore-log-alerts/configure-alerts-explore.md @@ -189,7 +189,9 @@ AI Agent Analysis runs **once every hour**. #### Configure the agent -Enabling AI Agent Analysis creates an OrionIQ agent for the alert. Select **Configure agent after saving** to open it right after you save, or manage it later from the Agents Hub — the alert form links to it with **Manage in Agent Hub**. +Enabling AI Agent Analysis creates an OrionIQ agent for the alert when you save it. Select **Configure your agent** to set the agent's instructions, output detail (Summary or Detailed), and recipients. **Apply** adds your changes to the alert form, and they are saved with the alert. Turning AI Agent Analysis off and saving removes the agent and its settings. + +For full agent configuration, use **Manage in Agents Hub**, which opens the agent in the Agents Hub. The agent is editable like any other, so beyond the settings on this page you can: diff --git a/docs/user-guide/orioniq/api.md b/docs/user-guide/orioniq/api.md index 958801da..0f64fa4f 100644 --- a/docs/user-guide/orioniq/api.md +++ b/docs/user-guide/orioniq/api.md @@ -2,13 +2,13 @@ sidebar_position: 9 title: OrionIQ API image: https://dytvr9ot2sszz.cloudfront.net/logz-docs/social-assets/docs-social.jpg -description: Trigger OrionIQ agents, poll for results, send follow-ups, and submit feedback using the OrionIQ API. -keywords: [OrionIQ, API, agents, trigger agent, agent run, feedback, api token, automation] +description: List agents, trigger OrionIQ agents, poll for results, send follow-ups, and submit feedback using the OrionIQ API. +keywords: [OrionIQ, API, agents, list agents, agent ID, trigger agent, agent run, feedback, api token, automation] --- Agents configured with the **API** trigger run on demand when you call the OrionIQ API. Use it to start a run from a CI pipeline, an incident workflow, or any external system, then poll for the result. -To get an agent's ID and a ready-to-copy request for each endpoint, open the agent's actions menu in the [Agents Hub](/docs/user-guide/orioniq/agents-hub/) and select **API References**. +To get an agent's ID and a ready-to-copy request for each endpoint, open the agent's actions menu in the [Agents Hub](/docs/user-guide/orioniq/agents-hub/) and select **API References**. To look agents up with the API instead, use [List agents](#list-agents). ## Authentication @@ -34,6 +34,78 @@ If AI features are disabled for the account, [Run an agent](#run-an-agent) and [ If the account has reached its configured AI usage cap, [Run an agent](#run-an-agent) and [Send a follow-up](#send-a-follow-up) return `429` (`errorCode: "CAP_EXCEEDED"`). See [OrionIQ Settings → Capping](/docs/user-guide/orioniq/settings/#capping) for usage and budget limits. ::: +## List agents + +``` +POST /v1/orioniq-be/agents/search +``` + +Returns the agents in the token's account, so you can find an agent ID without opening the Agents Hub. Sub-account agents are not included. Listing starts no AI work, so it also works when AI features are disabled. + +### Sample request + +```shell +curl -X POST -L \ + https://<>/v1/orioniq-be/agents/search \ + -H 'Content-Type: application/json' \ + -H 'X-API-TOKEN: <>' \ + -d '{ + "filter": { + "searchTerm": "checkout", + "active": true + }, + "pagination": { + "pageNumber": 1, + "pageSize": 20 + } + }' +``` + +All fields are optional. A filter value the API cannot use is ignored. + +| Field | Description | +|---|---| +| `filter.searchTerm` | Returns agents whose title contains this text. | +| `filter.type` | Filters by agent type. | +| `filter.trigger` | Filters by trigger. An unknown value returns no results. | +| `filter.active` | `true` for enabled agents, `false` for disabled ones. | +| `filter.createdBy` | Filters by creator. | +| `pagination.pageNumber` | The page to return. | +| `pagination.pageSize` | Results per page. Defaults to 50 and is capped at 50. | + +Results are ordered by creation time, newest first. + +### Response + +```json +{ + "total": 1, + "results": [ + { + "id": "", + "name": "", + "displayName": "Checkout Latency Review", + "description": "Reviews latency on the checkout service.", + "type": "", + "trigger": "", + "active": true, + "isSystemAgent": false, + "createdAt": "2026-10-01T08:00:00Z", + "updatedAt": "2026-10-10T09:30:00Z", + "lastRun": "2026-10-14T06:00:00Z" + } + ], + "pagination": { + "pageNumber": 1, + "pageSize": 20 + } +} +``` + +`total` is the number of matching agents across all pages. A page past the end returns an empty `results` list. Use `displayName` as the agent's title. Each `id` works as `<>` in the other endpoints. + +A request authenticated with a session or share token instead of an API token returns `401`. + ## Run an agent ``` From bbdcf0a6370790fe2b6c23fc5fb9ef925bbdd156 Mon Sep 17 00:00:00 2001 From: Claude Date: Fri, 16 Oct 2026 06:14:00 +0000 Subject: [PATCH 03/11] OrionIQ: document sort on the agent list API Co-Authored-By: Claude Sonnet 5.5 Claude-Session: https://claude.ai/code/session_014fwt4FrmMMCoEDMijbbRPA --- agents.md | 10 ++++++++++ docs/user-guide/orioniq/api.md | 10 +++++++++- 2 files changed, 19 insertions(+), 1 deletion(-) diff --git a/agents.md b/agents.md index 6dbb383b..08bf7950 100644 --- a/agents.md +++ b/agents.md @@ -733,3 +733,13 @@ No unresolved reviewer comments on the PR. No screenshots marked for documentati * `oiq-resources` - no commits. Existing PR #975 had no unresolved reviewer comments. No screenshots marked for documentation use. Assignees extended with the authors of the triggering commits. + +### 2026-10-16 - daily scan (since 2026-10-15 06:00), doc changes made + +* `Artemis` - #501 (Gavriel-M, ORIONIQ-1683): `POST /v1/orioniq-be/agents/search` now honors `sort` (first entry only; fields `name`, `type`, `active`, `createdAt`, `updatedAt`, `lastRun`; bad entry falls back to `createdAt` desc). Added the `sort` rows and example to **List agents** in `api.md`. Source: `agent-search-filters.ts` and the swagger constants. + * #492 (yotamloe, ORIONIQ-1841): agent builder takes its account from the session. Internal fix. #493 (RoyiSitbon): RCA report moved into `orion-chat`, still no verified copy. #498, #483: version packages. +* `gaia-hermes-ws` - #17217 (RoyiSitbon, ORIONIQ-1833): Open 360 drawer renders the RCA report and the onboarding survey is served by orioniq-be (`/orioniq-be/user-docs/survey`, session route). #17202, #17205, #17206, #17216 (Gavriel-M, ORIONIQ-1811, ORIONIQ-1830, ORIONIQ-1621): integrations picker and form-agnostic RCA agent setup modal, analytics events. Same RCA v2 flag as #17199 and #17200, no screenshots, not documented yet. #17211, #17212, #17214 (APPZ-3491): Swagger for other services, out of scope. +* `OIQ-AI-service` - #525, #521 (galangel): CI image tags and dev-namespace overrides. Internal. +* `oiq-resources` - #115 (Gavriel-M, ORIONIQ-1621): agent memory made configurable in marketplace templates. Still behind the `oiq-agent-docs` flag, not documented. Revisit when the flag is removed. + +Existing PR #975 had no unresolved reviewer comments. Appended to its branch. Gavriel-M, RoyiSitbon and galangel are the authors of triggering commits; vicmiletsky's commits were out of scope. diff --git a/docs/user-guide/orioniq/api.md b/docs/user-guide/orioniq/api.md index 0f64fa4f..f7a507f0 100644 --- a/docs/user-guide/orioniq/api.md +++ b/docs/user-guide/orioniq/api.md @@ -54,6 +54,12 @@ curl -X POST -L \ "searchTerm": "checkout", "active": true }, + "sort": [ + { + "field": "lastRun", + "descending": true + } + ], "pagination": { "pageNumber": 1, "pageSize": 20 @@ -70,10 +76,12 @@ All fields are optional. A filter value the API cannot use is ignored. | `filter.trigger` | Filters by trigger. An unknown value returns no results. | | `filter.active` | `true` for enabled agents, `false` for disabled ones. | | `filter.createdBy` | Filters by creator. | +| `sort` | A list where only the first entry is used. Each entry takes a `field` and an optional `descending` flag (default `false`). | +| `sort[].field` | One of `name`, `type`, `active`, `createdAt`, `updatedAt`, or `lastRun`. | | `pagination.pageNumber` | The page to return. | | `pagination.pageSize` | Results per page. Defaults to 50 and is capped at 50. | -Results are ordered by creation time, newest first. +Results are ordered by creation time, newest first, unless you set `sort`. An unusable `sort` entry falls back to the default order. In ascending order, agents that never ran come first when sorting by `lastRun`. ### Response From ae2595ff4e95808ef0a076c272f0aa99a71c93bb Mon Sep 17 00:00:00 2001 From: Claude Date: Mon, 19 Oct 2026 06:17:08 +0000 Subject: [PATCH 04/11] OrionIQ: log 2026-10-19 scan, no doc changes --- agents.md | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/agents.md b/agents.md index 08bf7950..12a7e7c9 100644 --- a/agents.md +++ b/agents.md @@ -743,3 +743,12 @@ Existing PR #975 had no unresolved reviewer comments. No screenshots marked for * `oiq-resources` - #115 (Gavriel-M, ORIONIQ-1621): agent memory made configurable in marketplace templates. Still behind the `oiq-agent-docs` flag, not documented. Revisit when the flag is removed. Existing PR #975 had no unresolved reviewer comments. Appended to its branch. Gavriel-M, RoyiSitbon and galangel are the authors of triggering commits; vicmiletsky's commits were out of scope. + +### 2026-10-19 - daily scan (since 2026-10-18 06:00), no doc changes + +* `Artemis` - #494 (Gavriel-M, ORIONIQ-1621): agent memory now covers every agent except chat and Alert AI Analysis v1, on by default per run. Still shown only when `memoryAvailable` answers true, which needs the pod-mounted `oiq-agent-docs` flag. Not documented. Revisit when the flag is removed. +* `OIQ-AI-service` - #526 (augment770-dev, ORIONIQ-1827): Haiku 5.5 and named invocation profiles. #529 (yotamloe, ORIONIQ-1486): `@timestamp` rejected in aggregation tools. #532 (ralongit): agents may use the integration writes they hold. Internal runtime and prompt behavior, no public route or schema change. +* `oiq-resources` - #116 to #119 (ralongit, ORIONIQ-1377): fixes to the Alert Digest and Alert Tuning Report templates and the `logzio_api.md` skill (unified alert events filters, log-alert grouping by title, alert links by name). The six tuning patterns and the alert links already match the `marketplace.md` descriptions. No doc change. +* `gaia-hermes-ws` - no commits. + +Existing PR #975 had no unresolved reviewer comments and is approved. No screenshots marked for documentation use. Appended the log entry only. Assignees unchanged. From fd730f2014de514a4521e30e5759d03394333659 Mon Sep 17 00:00:00 2001 From: Claude Date: Tue, 20 Oct 2026 06:16:53 +0000 Subject: [PATCH 05/11] OrionIQ: feedback reflections are free, marketplace templates default to Detailed --- agents.md | 10 ++++++++++ docs/user-guide/orioniq/create-agent.md | 2 +- docs/user-guide/orioniq/marketplace.md | 4 ++-- 3 files changed, 13 insertions(+), 3 deletions(-) diff --git a/agents.md b/agents.md index 12a7e7c9..4fe8bce5 100644 --- a/agents.md +++ b/agents.md @@ -752,3 +752,13 @@ Existing PR #975 had no unresolved reviewer comments. Appended to its branch. Ga * `gaia-hermes-ws` - no commits. Existing PR #975 had no unresolved reviewer comments and is approved. No screenshots marked for documentation use. Appended the log entry only. Assignees unchanged. + +### 2026-10-20 - daily scan (since 2026-10-19 06:00), doc changes made + +* `Artemis` - #512 (yotamloe, ORIONIQ-1858): feedback reflections are free. Price $0, no free-usage count, no AI budget check, still recorded as a $0 invocation. Removed the "$1 after 20 free" note in `create-agent.md`. + * #507 (ralongit, ORIONIQ-1850): Connect modal shows Agent permissions above How to connect and hides the auth-method tile for single-method integrations. `integrations.md` stays accurate. #495, #496 (Gavriel-M, ORIONIQ-1621): shared Memory files on an agent, still behind the memory flag, not documented. #508 (RoyiSitbon): RCA report tidy-up, still no verified copy. #503, #513, #514: internal. +* `oiq-resources` - 9a7ff36 (ralongit): `alert-tuning-report` and `scheduled-error-logs-report` moved from Summary to Detailed. Every template now ships Detailed, so `marketplace.md` says so instead of "Summary by default". +* `gaia-hermes-ws` (`master`) - #17208, #17221 (Gavriel-M, ORIONIQ-1830, 1849): the alerts list AI Analysis cell opens the RCA agent setup dialog directly. Not documented: `triggered-alerts.md` covers the triggered list, and no verified copy exists for the alert configuration list. #17209 (APPZ-3497): AI Observability drilldown, out of scope. +* `OIQ-AI-service` - #536, #527, #533 (kevkle, RoyiSitbon), #535, #534 (augment770-dev): RCA OIHV internals, model construction, smoke-test fake LLM. Internal. + +Existing PR #975 had no unresolved reviewer comments. Merged `master` into its branch (it was behind). No screenshots marked for documentation use. Assignees extended with yotamloe and ralongit. diff --git a/docs/user-guide/orioniq/create-agent.md b/docs/user-guide/orioniq/create-agent.md index a4304ed3..1d4e761d 100644 --- a/docs/user-guide/orioniq/create-agent.md +++ b/docs/user-guide/orioniq/create-agent.md @@ -119,7 +119,7 @@ Agents can learn from the feedback you leave on their invocations (see [Provide An agent can hold up to 20 active lessons at a time. As that limit gets close, a warning appears here; once it's reached, new feedback is acknowledged but produces no further lessons until you disable an existing one to make room. :::note -Writing a note is billed once it's accepted for review, whether or not it ends up teaching the agent anything: the first 20 reflections per account are free (all-time), then $1 each. +Writing a note is free. Each accepted note is still recorded as an invocation, at no cost, and it does not count against your AI budget. ::: ## Finalize and create diff --git a/docs/user-guide/orioniq/marketplace.md b/docs/user-guide/orioniq/marketplace.md index f8a3f615..43260476 100644 --- a/docs/user-guide/orioniq/marketplace.md +++ b/docs/user-guide/orioniq/marketplace.md @@ -49,14 +49,14 @@ The template decides which sections the dialog shows. A section appears only whe |---|---| | **Trigger** | The trigger type and, for a scheduled agent, the schedule. | | **Runbook** | The instructions for agents triggered by an API call, an alert, or a deployment. A scheduled agent shows its context message and run frequency instead. | -| **Output detail** | **Summary** by default, unless the template sets a level. | +| **Output detail** | The template's level. Every current template starts at **Detailed**. | | **Data sources** | The accounts the agent reads from. For an agent that reads logs, the account you are on is selected by default. | | **Integrations** | The integrations the agent can use. | | **Notification recipients** | Who gets notified of the agent's results. | Data sources, Integrations, and Notification recipients appear as one-line summaries that expand in place. If something required is missing, such as a data source or a reconnected integration, the row opens so you can fix it. -Learning is off for agents activated from the Marketplace, because it is billed separately. You can turn it on later in the agent's **Agent details** form. See [Learning](/docs/user-guide/orioniq/create-agent/). +Learning is off for agents activated from the Marketplace. You can turn it on later in the agent's **Agent details** form. See [Learning](/docs/user-guide/orioniq/create-agent/). Click **All settings** to move your draft into the full agent form in the side panel, with everything you entered so far. Click **Show details** or **Hide details** to switch between the template description and the setup form. From 565baf557a2964d80be07fe62677585e1bdbca3b Mon Sep 17 00:00:00 2001 From: Claude Date: Wed, 21 Oct 2026 06:18:36 +0000 Subject: [PATCH 06/11] OrionIQ: document Exception Analysis template and the updated agent setup dialog --- agents.md | 10 ++++++++++ docs/open360/alerts/configure-alerts-explore.md | 2 +- .../cloud-siem/security-rules/manage-security-rules.md | 2 +- .../explore-log-alerts/configure-alerts-explore.md | 2 +- docs/user-guide/orioniq/marketplace.md | 1 + 5 files changed, 14 insertions(+), 3 deletions(-) diff --git a/agents.md b/agents.md index 4fe8bce5..3da7a70f 100644 --- a/agents.md +++ b/agents.md @@ -762,3 +762,13 @@ Existing PR #975 had no unresolved reviewer comments and is approved. No screens * `OIQ-AI-service` - #536, #527, #533 (kevkle, RoyiSitbon), #535, #534 (augment770-dev): RCA OIHV internals, model construction, smoke-test fake LLM. Internal. Existing PR #975 had no unresolved reviewer comments. Merged `master` into its branch (it was behind). No screenshots marked for documentation use. Assignees extended with yotamloe and ralongit. + +### 2026-10-21 - daily scan (since 2026-10-20 06:09), doc changes made + +* `gaia-hermes-ws` - #17224, #17227 (Gavriel-M, ORIONIQ-1849, ORIONIQ-1861): the **Configure your agent** dialog now has a **Data sources** section (alert accounts plus added log or metrics accounts), shows the agent's price per run with free runs left, and no longer has an output detail field. Updated the three pages that list the dialog settings: both `configure-alerts-explore.md` twins and `manage-security-rules.md`. The SIEM page does not mention data sources, since the section only renders when the form passes an alert scope. Source of truth: `RcaAgentSetupSections.tsx` and `rca-agent-setup-price.util.ts`. + * #17229 (internal legacy dashboard endpoints for support tools), #17228, #17226, #17225, #17215, #17210, #17219: out of OrionIQ scope. +* `oiq-resources` - 8d07ead (ralongit, ORIONIQ-1434): the **Exception Analysis** template ships to `main` (category Incident, weekly by default, requires the Exceptions capability from Logz.io Support). Added a row to the Available templates table in `marketplace.md`. The 2026-10-20 revert and reapply of the same merge is net zero. +* `Artemis` - #504 (Gavriel-M, ORIONIQ-1849): the alert RCA session route accepts data sources. Session route, not part of the public `/v2` API. #497 (Gavriel-M) and #530: memory file usage, still behind the memory flag. #522 (RoyiSitbon): RCA report fixes, still no verified copy. #517, #510, #519, #499: UI colour, avatar, vendor and version chores. +* `OIQ-AI-service` - #544, #543 (kevkle, RoyiSitbon): the OIHV RCA answer contract moves to 5.0.0 with customer status wording, an App-AI contract and not a public OrionIQ route. #524 (yotamloe): memory doc audit events to the gaia audit indexer, off unless configured. #530: kb_delete guard. No doc change. + +Existing PR #975 had no unresolved reviewer comments. Merged `master` into its branch. No screenshots marked for documentation use. Assignees already include the authors of the triggering commits. diff --git a/docs/open360/alerts/configure-alerts-explore.md b/docs/open360/alerts/configure-alerts-explore.md index 46ae6ffe..b33aaabb 100644 --- a/docs/open360/alerts/configure-alerts-explore.md +++ b/docs/open360/alerts/configure-alerts-explore.md @@ -216,7 +216,7 @@ Once triggered, the AI Agent will analyze related logs, metrics, and patterns. A #### Configure the agent -Enabling AI Agent Analysis creates an OrionIQ agent for the alert when you save it. Select **Configure your agent** to set the agent's instructions, output detail (Summary or Detailed), and recipients. **Apply** adds your changes to the alert form, and they are saved with the alert. Turning AI Agent Analysis off and saving removes the agent and its settings. +Enabling AI Agent Analysis creates an OrionIQ agent for the alert when you save it. Select **Configure your agent** to set the agent's instructions, data sources, integrations, and recipients. **Data sources** lists the accounts the alert covers, and you can add log or metrics accounts for the agent to investigate. The dialog also shows the agent's price per run, with any free runs left. **Apply** adds your changes to the alert form, and they are saved with the alert. Turning AI Agent Analysis off and saving removes the agent and its settings. For full agent configuration, use **Manage in Agents Hub**, which opens the agent in the Agents Hub. diff --git a/docs/user-guide/cloud-siem/security-rules/manage-security-rules.md b/docs/user-guide/cloud-siem/security-rules/manage-security-rules.md index ed1a0a0f..9c7eed83 100644 --- a/docs/user-guide/cloud-siem/security-rules/manage-security-rules.md +++ b/docs/user-guide/cloud-siem/security-rules/manage-security-rules.md @@ -176,7 +176,7 @@ Every run is stored in the agent's invocation history, where you can read the fu #### Configure the agent -Turning the toggle on creates an OrionIQ agent for the rule when you save it. Select **Configure your agent** to set the agent's instructions, output detail (Summary or Detailed), and recipients. **Apply** adds your changes to the rule form, and they are saved with the rule. Turning the toggle off and saving removes the agent and its settings. The button is disabled on protected rules and for read-only users. +Turning the toggle on creates an OrionIQ agent for the rule when you save it. Select **Configure your agent** to set the agent's instructions, integrations, and recipients. The dialog also shows the agent's price per run, with any free runs left. **Apply** adds your changes to the rule form, and they are saved with the rule. Turning the toggle off and saving removes the agent and its settings. The button is disabled on protected rules and for read-only users. For full agent configuration, use **Manage in Agents Hub**, which opens the agent in the Agents Hub. diff --git a/docs/user-guide/explore/explore-log-alerts/configure-alerts-explore.md b/docs/user-guide/explore/explore-log-alerts/configure-alerts-explore.md index c32de99e..19f34c8e 100644 --- a/docs/user-guide/explore/explore-log-alerts/configure-alerts-explore.md +++ b/docs/user-guide/explore/explore-log-alerts/configure-alerts-explore.md @@ -189,7 +189,7 @@ AI Agent Analysis runs **once every hour**. #### Configure the agent -Enabling AI Agent Analysis creates an OrionIQ agent for the alert when you save it. Select **Configure your agent** to set the agent's instructions, output detail (Summary or Detailed), and recipients. **Apply** adds your changes to the alert form, and they are saved with the alert. Turning AI Agent Analysis off and saving removes the agent and its settings. +Enabling AI Agent Analysis creates an OrionIQ agent for the alert when you save it. Select **Configure your agent** to set the agent's instructions, data sources, integrations, and recipients. **Data sources** lists the accounts the alert covers, and you can add log or metrics accounts for the agent to investigate. The dialog also shows the agent's price per run, with any free runs left. **Apply** adds your changes to the alert form, and they are saved with the alert. Turning AI Agent Analysis off and saving removes the agent and its settings. For full agent configuration, use **Manage in Agents Hub**, which opens the agent in the Agents Hub. diff --git a/docs/user-guide/orioniq/marketplace.md b/docs/user-guide/orioniq/marketplace.md index 6a7228ed..565d2093 100644 --- a/docs/user-guide/orioniq/marketplace.md +++ b/docs/user-guide/orioniq/marketplace.md @@ -34,6 +34,7 @@ Use the search bar at the top of the page to find specific agent templates, or c | **Alert AI Analysis** | Incident | When an alert fires | Correlates error logs, related metric anomalies, recent deployments, and the affected request paths, then summarizes the root cause with recommended remediation steps. This is the agent behind [AI Agent Analysis](/docs/open360/observability/ai-agent-analysis/). | | **Root Cause Analysis** | Incident | On demand (API) | Reconstructs the incident timeline, correlates logs, metrics, and traces, inspects recent deployments and configuration changes, and produces a ranked set of probable root causes with supporting evidence and remediation recommendations. | | **Incident Triage** | Incident | On demand (API) | Loads your runbook, walks through its diagnostic steps against live logs and metrics, evaluates the findings against the runbook's decision points, applies the prescribed remediation guidance, and produces a prioritized list of next steps for the responder. | +| **Exception Analysis** | Incident | Weekly | Reads the exceptions Logz.io already clusters for your account and groups variants of the same fault into families. Each family is sorted as new, spiking, ongoing, resolved, or muted, with occurrence counts, a trend, and a link to the logs. Daily runs open with a ranked list of what needs attention today. Exceptions you ask it to ignore stay muted, with your reason, until you ask for them back. Requires the Exceptions capability on the account, which Logz.io Support enables. | | **Alert Digest** | Alerting | Weekly | Summarizes what fired, what resolved, and how long alerts stayed triggered, with a period-over-period comparison, top offenders, first-time alerts, and incident-like episodes. | | **Alert Tuning Report** | Alerting | Weekly | Analyzes triggered-alert history across log and metric alerts and produces a ranked list of concrete tuning recommendations: flapping alerts, fast self-resolvers, severity miscalibration, alerts that always fire together, dead alerts, and services whose alerts went quiet. Each recommendation cites the current value, the proposed value, the supporting numbers, and a link to the alert definition. | | **Error Logs Analysis** | Alerting | Daily | Breaks down errors and warnings by application, compares them with the previous period, and highlights spikes. | From 579fdac6baba0325d1230e6a1d7f0d8354be443e Mon Sep 17 00:00:00 2001 From: Claude Date: Fri, 23 Oct 2026 06:16:06 +0000 Subject: [PATCH 07/11] OrionIQ: document the Log Patterns Analysis template Co-Authored-By: Claude Sonnet 5.5 Claude-Session: https://claude.ai/code/session_01GxrkRmsmex4HnuzDV7P5Lk --- agents.md | 10 ++++++++++ docs/user-guide/orioniq/marketplace.md | 1 + 2 files changed, 11 insertions(+) diff --git a/agents.md b/agents.md index 3da7a70f..d8de5f34 100644 --- a/agents.md +++ b/agents.md @@ -772,3 +772,13 @@ Existing PR #975 had no unresolved reviewer comments. Merged `master` into its b * `OIQ-AI-service` - #544, #543 (kevkle, RoyiSitbon): the OIHV RCA answer contract moves to 5.0.0 with customer status wording, an App-AI contract and not a public OrionIQ route. #524 (yotamloe): memory doc audit events to the gaia audit indexer, off unless configured. #530: kb_delete guard. No doc change. Existing PR #975 had no unresolved reviewer comments. Merged `master` into its branch. No screenshots marked for documentation use. Assignees already include the authors of the triggering commits. + +### 2026-10-23 - daily scan (since 2026-10-22 06:00), doc changes made + +* `oiq-resources` - #100 (ralongit, ORIONIQ-1450): the **Log Patterns Analysis** template ships to `main` (category Alerting, weekly by default, daily by editing the message's cadence line). Added a row to the Available templates table in `marketplace.md`. Follow-up commits (#147 and others) only tune the report shape. + * ORIONIQ-1894 (ralongit): a SigmaHQ keyless integration and a CVE-to-Cloud-SIEM-rule procedure in the `logzio_security_api` skill, with `OIQ-AI-service` #591 adding the `convert_sigma_rule` tool. It is chat and agent behavior on Cloud SIEM tenants with no UI or public route, and OrionIQ for SIEM is still undocumented. Not documented. Revisit with the OrionIQ chat page. +* `Artemis` - #543 (ralongit): Log Patterns Analysis price, label and tag colour. Prices are per-environment config, not documented. #561 (RoyiSitbon): `Custom3` "POC" agent type, free per invocation, behind `oiq-hermes-agent-types`. Not documented while flagged. #556: service-to-service route without a session, internal. #557, #551, #549, #550: UI and body-limit chores. +* `OIQ-AI-service` - #464 (`get_log_patterns` tool, no route), #592 (kevkle, RCA OIHV eligibility), #569 (research sim). Internal. +* `gaia-hermes-ws` - #17235, #17218 (TypeScript and Node upgrades), #17197 (Unified Dashboards trace drilldown). Out of OrionIQ scope. + +Existing PR #975 had no unresolved reviewer comments. Merged `master` into its branch. No screenshots marked for documentation use. Assignees already include the authors of the triggering commits. diff --git a/docs/user-guide/orioniq/marketplace.md b/docs/user-guide/orioniq/marketplace.md index 565d2093..55a66971 100644 --- a/docs/user-guide/orioniq/marketplace.md +++ b/docs/user-guide/orioniq/marketplace.md @@ -38,6 +38,7 @@ Use the search bar at the top of the page to find specific agent templates, or c | **Alert Digest** | Alerting | Weekly | Summarizes what fired, what resolved, and how long alerts stayed triggered, with a period-over-period comparison, top offenders, first-time alerts, and incident-like episodes. | | **Alert Tuning Report** | Alerting | Weekly | Analyzes triggered-alert history across log and metric alerts and produces a ranked list of concrete tuning recommendations: flapping alerts, fast self-resolvers, severity miscalibration, alerts that always fire together, dead alerts, and services whose alerts went quiet. Each recommendation cites the current value, the proposed value, the supporting numbers, and a link to the alert definition. | | **Error Logs Analysis** | Alerting | Daily | Breaks down errors and warnings by application, compares them with the previous period, and highlights spikes. | +| **Log Patterns Analysis** | Alerting | Weekly | Reads the patterns Logz.io already groups your logs into, for this period and the one before, at any log level. It reports patterns that are new, growing against their own earlier count, steady, or gone. Each item names the pattern's level and service and links to its logs, and the report closes with the share of logs the patterns matched. Exception-tagged logs are left to Exception Analysis. For a daily report, set the schedule to daily and change the opening "Cadence: weekly" in the message to "Cadence: daily". | | **Log Distribution Monitor** | Performance | Daily | Analyzes log volume distribution and trends across services to detect anomalies, identify cost drivers, and keep logging healthy. | ### How Incident Triage works From 1295a4db5f0c8eadd296d9ccf9604f188e5bfe59 Mon Sep 17 00:00:00 2001 From: Claude Date: Mon, 26 Oct 2026 06:20:10 +0000 Subject: [PATCH 08/11] OrionIQ: document marketplace tags, account pricing, template form limits, and trigger changes Co-Authored-By: Claude Sonnet 5.5 Claude-Session: https://claude.ai/code/session_01XnPCmpQm7Ta5GKdKSWGJid --- agents.md | 7 +++++++ docs/user-guide/orioniq/create-agent.md | 11 ++++++----- docs/user-guide/orioniq/marketplace.md | 8 ++++++-- 3 files changed, 19 insertions(+), 7 deletions(-) diff --git a/agents.md b/agents.md index d8de5f34..00e2d563 100644 --- a/agents.md +++ b/agents.md @@ -782,3 +782,10 @@ Existing PR #975 had no unresolved reviewer comments. Merged `master` into its b * `gaia-hermes-ws` - #17235, #17218 (TypeScript and Node upgrades), #17197 (Unified Dashboards trace drilldown). Out of OrionIQ scope. Existing PR #975 had no unresolved reviewer comments. Merged `master` into its branch. No screenshots marked for documentation use. Assignees already include the authors of the triggering commits. + +### 2026-10-26 + +* `Artemis` - #559, #547, #565, #530, #529 (Gavriel-M, ORIONIQ-1876, 1869, 1877, 1868, 1870): marketplace card Data and Trigger tags, per-account template price, template-locked "All settings" form and required Triage runbook, Deployment trigger no longer offered, whole-hour schedules and local weekly day, 191-character name and description limit. Updated `marketplace.md` and `create-agent.md`. The create-agent and marketplace routes are not in the public `api.md`, so their new 400/404/503 shapes are not documented. #528, #552, #553, #571: design system and base image chores. +* `oiq-resources` - #143, #145 (ralongit): agent skill text for CVE research and SIEM rule guards. No UI or public route. Not documented. +* `OIQ-AI-service`, `gaia-hermes-ws` - no commits in the window. +* PR #975 had no unresolved comments. Commits for this run were pushed to its existing branch `claude/gracious-thompson-n77ck0`, not the session branch. diff --git a/docs/user-guide/orioniq/create-agent.md b/docs/user-guide/orioniq/create-agent.md index b0bf2c00..8e437f16 100644 --- a/docs/user-guide/orioniq/create-agent.md +++ b/docs/user-guide/orioniq/create-agent.md @@ -40,8 +40,8 @@ The configuration is a series of sections. Work through them in order. | Field | Description | |---|---| -| **Agent Name** | A descriptive name for your agent. | -| **Description** | A brief explanation of what the agent does. | +| **Agent Name** | A descriptive name for your agent, up to 191 characters. It can't start with `logz-` or `orioniq-general`. | +| **Description** | A brief explanation of what the agent does, up to 191 characters. | | **Active** | Enable or disable the agent. When disabled, it won't run regardless of its trigger. For an alert-linked agent this is managed from the alert definition. | ### Agent Definition @@ -70,7 +70,7 @@ Structured output schemas must be flat: properties can be primitives or arrays o |---|---| | **Type** | The agent type. Determines how the agent is priced and which data it can reach. | | **Trigger** | How the agent runs — see below. | -| **Schedule** | For a Scheduled trigger, the interval the agent runs on. | +| **Schedule** | For a Scheduled trigger, the interval the agent runs on. An hourly interval must be a whole number of hours. A weekly schedule shows the day in your local time. | Choose how the agent will run by selecting a trigger type: @@ -78,9 +78,10 @@ Choose how the agent will run by selecting a trigger type: |---|---| | **API** | The agent runs when called via the [OrionIQ API](/docs/user-guide/orioniq/api/). Use this for on-demand or externally triggered invocations. | | **Scheduled** | The agent runs automatically at defined intervals (for example, every 3 hours or once a day). | -| **Deployment** | The agent runs automatically when a deployment event is detected. | | **Alert** | The agent runs automatically when a Logz.io alert is triggered. | +The Deployment trigger is no longer offered. An agent already set to it still shows it, but nothing starts it, so switch it to another trigger. + ### Daily Invocation Cap Each agent invocation incurs a cost. Set the maximum number of invocations per day to control your usage budget. Leave it empty for unlimited invocations, or set it to 0 to block the agent completely. @@ -95,7 +96,7 @@ Pick the observability platform and accounts this agent can query. Toggle the sc With **Logs + Metrics (deep)**, a coordinating agent plans the investigation and assigns each part to specialized logs, metrics, and integration sub-agents, then combines their findings. It decides each next step from what the previous step returned rather than following a fixed sequence. -Data Sources is available for every trigger type. Which scopes you have to fill in follows the **Agent tools** you chose above: a scheduled agent declaring a logs tool set needs a logs data source, and it won't save until every declared scope has one. For API, Alert, and Deployment agents, picking a data source is optional. +Data Sources is available for every trigger type. Which scopes you have to fill in follows the **Agent tools** you chose above: a scheduled agent declaring a logs tool set needs a logs data source, and it won't save until every declared scope has one. For API and Alert agents, picking a data source is optional. When you create an alert-linked AI analysis agent, it starts with the accounts named in the alert, and you can edit them here. If the alert queries all accounts, the agent follows the alert instead and picks up new sub-accounts. Later changes to the alert don't overwrite the accounts you saved. If you remove every account, the agent falls back to the alert's accounts. diff --git a/docs/user-guide/orioniq/marketplace.md b/docs/user-guide/orioniq/marketplace.md index 55a66971..79485199 100644 --- a/docs/user-guide/orioniq/marketplace.md +++ b/docs/user-guide/orioniq/marketplace.md @@ -25,6 +25,8 @@ Agent templates are organized into the following categories: | **Alerting** | Agents that filter and prioritize alerts to surface high-confidence, high-impact events. | | **Performance** | Agents that identify early degradation patterns in latency, error rates, and throughput. | +Each card shows two tags: **Data** (Logs, Metrics, or Logs + Metrics) and **Trigger** (Scheduled, On demand, or Per alert). A card whose template sets neither shows no tags. + Use the search bar at the top of the page to find specific agent templates, or click a category tab to filter the list. ## Available templates @@ -58,7 +60,7 @@ The template decides which sections the dialog shows. A section appears only whe | Section | What you set | |---|---| | **Trigger** | The trigger type and, for a scheduled agent, the schedule. | -| **Runbook** | The instructions for agents triggered by an API call, an alert, or a deployment. A scheduled agent shows its context message and run frequency instead. | +| **Runbook** | Required when the template needs one, as for Incident Triage. The instructions for agents triggered by an API call, an alert, or a deployment. A scheduled agent shows its context message and run frequency instead. | | **Output detail** | The template's level. Every current template starts at **Detailed**. | | **Data sources** | The accounts the agent reads from. For an agent that reads logs, the account you are on is selected by default. | | **Integrations** | The integrations the agent can use. | @@ -68,7 +70,7 @@ Data sources, Integrations, and Notification recipients appear as one-line summa Learning is off for agents activated from the Marketplace. You can turn it on later in the agent's **Agent details** form. See [Learning](/docs/user-guide/orioniq/create-agent/). -Click **All settings** to move your draft into the full agent form in the side panel, with everything you entered so far. Click **Show details** or **Hide details** to switch between the template description and the setup form. +Click **All settings** to move your draft into the full agent form in the side panel, with everything you entered so far. The form offers only the fields the template lets you change, plus the name, description, and **Active**. Click **Show details** or **Hide details** to switch between the template description and the setup form. If you close the dialog after changing the setup, OrionIQ asks before it discards your changes. @@ -82,6 +84,8 @@ Every agent you activate from the Marketplace starts with a free trial. The temp When the free runs are used, the agent switches off automatically and nothing is charged. In the [Agents Hub](/docs/user-guide/orioniq/agents-hub/), the **Cost** column shows the runs left, and an agent whose trial is over is marked **Trial ended**. Nothing runs or is charged until you turn it back on, and turning it on again asks you to confirm that each run is billed. +Template cards and previews show your account's own price per run. If the price can't be loaded, the price is left out and the free trial is still offered. + If you can see pricing, the activation dialog and the agent form also offer **Keep running after the free runs**. Select it to let the agent keep running, billed per run, once the trial ends. If a template you're interested in is not yet available, click **Add to Wish List** to signal your interest. This helps Logz.io prioritize which templates to build next. From 30541b140e43a9c0c531b4882d1028a1bc1202d4 Mon Sep 17 00:00:00 2001 From: Claude Date: Tue, 27 Oct 2026 06:16:11 +0000 Subject: [PATCH 09/11] OrionIQ: document lessons endpoints, run context.security, and schedule time zones Co-Authored-By: Claude Sonnet 5.5 Claude-Session: https://claude.ai/code/session_01BRBAwC9wMkeHrPTnEvnWT5 --- agents.md | 4 ++ docs/user-guide/orioniq/api.md | 64 ++++++++++++++++++++++++- docs/user-guide/orioniq/create-agent.md | 2 +- 3 files changed, 68 insertions(+), 2 deletions(-) diff --git a/agents.md b/agents.md index 00e2d563..86f6311c 100644 --- a/agents.md +++ b/agents.md @@ -789,3 +789,7 @@ Existing PR #975 had no unresolved reviewer comments. Merged `master` into its b * `oiq-resources` - #143, #145 (ralongit): agent skill text for CVE research and SIEM rule guards. No UI or public route. Not documented. * `OIQ-AI-service`, `gaia-hermes-ws` - no commits in the window. * PR #975 had no unresolved comments. Commits for this run were pushed to its existing branch `claude/gracious-thompson-n77ck0`, not the session branch. + +## Run notes + +* 2026-10-27: The in-app API reference (`api-endpoints.ts`) now lists lessons and agents search. `api.md` mirrors both. Schedule validation and `schedule.tz` (ORIONIQ-1880) are documented in one line on the Schedule row of `create-agent.md`, since `POST` and `PUT /orioniq-be/agents` are not on the public API page. diff --git a/docs/user-guide/orioniq/api.md b/docs/user-guide/orioniq/api.md index f7a507f0..0915ca3d 100644 --- a/docs/user-guide/orioniq/api.md +++ b/docs/user-guide/orioniq/api.md @@ -146,7 +146,7 @@ curl -X POST -L \ | `context.message` | The prompt for this run. | | `context.additionalContext` | Optional free-text context to pass to the agent. | | `context.timerange` | Optional `startTime` and `endTime` bounding the data the agent analyzes. | -| `context.security` | Optional list of accounts to query, each with an optional `filter` of `field` and `value`. | +| `context.security` | The accounts the run reads. Each entry takes a `requestedAccountId`, a `type` of `log` or `metric`, and an optional `filter` of `field` and `value`. Always send at least one entry. Without it, the run falls back to the accounts saved on the agent, and a Scheduled agent, or one with none saved, fails with `422`. An account the API token can't read is dropped, and a run with none left is rejected with `403`. | | `integrations` | Optional list of integration connections the run may use. | Fields you send override the matching fields in the agent's saved **Payload (JSON)**. @@ -294,3 +294,65 @@ Returns the feedback record for a run, in the same shape as a single entry in th :::note Agents don't have to be reachable over the API to be rated. Runs started by a Scheduled, Deployment, or Alert trigger can be rated from the Agents Hub, and the same feedback endpoints apply to them. ::: + +## List lessons + +``` +GET /v2/ai-agent/<>/lessons +``` + +Returns what the agent has learned from feedback. Active lessons are applied to the agent's runs while its Learning setting is on. + +### Sample request + +```shell +curl -X GET -L \ + https://<>/v2/ai-agent/<>/lessons \ + -H 'X-API-TOKEN: <>' +``` + +### Response + +```json +{ + "lessons": [ + { + "lessonId": "", + "status": "active", + "situation": "", + "rule": "", + "whyNote": "", + "feedbackRef": ":", + "createdAt": "2026-10-14T06:00:00Z", + "lastLoaded": "2026-10-15T06:00:00Z", + "isUpdated": false + } + ] +} +``` + +`status` is `active` or `disabled`. Apart from `lessonId` and `isUpdated`, every field is optional and can be missing. + +## Set lesson status + +``` +PUT /v2/ai-agent/<>/lessons//status +``` + +Turns a lesson on or off. A disabled lesson is kept but no longer applied to the agent's runs. + +### Sample request + +```shell +curl -X PUT -L \ + https://<>/v2/ai-agent/<>/lessons//status \ + -H 'Content-Type: application/json' \ + -H 'X-API-TOKEN: <>' \ + -d '{ + "enabled": false + }' +``` + +### Response + +The updated lesson, in the same shape as an entry in the List lessons response, with `status` set to `disabled` or `active`. diff --git a/docs/user-guide/orioniq/create-agent.md b/docs/user-guide/orioniq/create-agent.md index 8e437f16..435f8a31 100644 --- a/docs/user-guide/orioniq/create-agent.md +++ b/docs/user-guide/orioniq/create-agent.md @@ -70,7 +70,7 @@ Structured output schemas must be flat: properties can be primitives or arrays o |---|---| | **Type** | The agent type. Determines how the agent is priced and which data it can reach. | | **Trigger** | How the agent runs — see below. | -| **Schedule** | For a Scheduled trigger, the interval the agent runs on. An hourly interval must be a whole number of hours. A weekly schedule shows the day in your local time. | +| **Schedule** | For a Scheduled trigger, the interval the agent runs on. An hourly interval must be a whole number of hours. A weekly schedule shows the day in your local time. The agent runs at the hour in its saved time zone, and follows daylight saving changes. An agent with no saved time zone runs on UTC. | Choose how the agent will run by selecting a trigger type: From 935f7b1e7580fc0407cd3a1c7457064db3cb6848 Mon Sep 17 00:00:00 2001 From: Gal Angel Date: Wed, 28 Oct 2026 08:16:31 +0200 Subject: [PATCH 10/11] OrionIQ: document the schedule time zone select Co-Authored-By: Claude Sonnet 5.5 Claude-Session: https://claude.ai/code/session_01BRBAw8M7Ci5P7qMeAHCtub --- docs/user-guide/orioniq/create-agent.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/user-guide/orioniq/create-agent.md b/docs/user-guide/orioniq/create-agent.md index 435f8a31..35285f71 100644 --- a/docs/user-guide/orioniq/create-agent.md +++ b/docs/user-guide/orioniq/create-agent.md @@ -70,7 +70,7 @@ Structured output schemas must be flat: properties can be primitives or arrays o |---|---| | **Type** | The agent type. Determines how the agent is priced and which data it can reach. | | **Trigger** | How the agent runs — see below. | -| **Schedule** | For a Scheduled trigger, the interval the agent runs on. An hourly interval must be a whole number of hours. A weekly schedule shows the day in your local time. The agent runs at the hour in its saved time zone, and follows daylight saving changes. An agent with no saved time zone runs on UTC. | +| **Schedule** | For a Scheduled trigger, the interval the agent runs on. An hourly interval must be a whole number of hours. The agent saves the time zone you pick (**Local** uses your browser's time zone, or choose **UTC**), and runs at the hour and weekly day you set in that zone, following daylight saving changes. An agent saved before time zones were stored runs on UTC and shows its hour converted to your local time. When the agent's time zone differs from yours, the schedule summary and the marketplace plan name it, for example "Weekly on Monday at 09:00 (America/New_York)". | Choose how the agent will run by selecting a trigger type: From ef15a11f3cbbf79ccc436b98774f2e2b12fcb429 Mon Sep 17 00:00:00 2001 From: Claude Date: Thu, 29 Oct 2026 06:14:43 +0000 Subject: [PATCH 11/11] docs(orioniq): document guided marketplace activation and agent access 404 Co-Authored-By: Claude Sonnet 5.5 Claude-Session: https://claude.ai/code/session_01BRBAwBiLUxuDCxqGtgqxgJ --- agents.md | 5 +++ docs/user-guide/orioniq/api.md | 2 +- docs/user-guide/orioniq/marketplace.md | 62 +++++++++++++++++++------- 3 files changed, 52 insertions(+), 17 deletions(-) diff --git a/agents.md b/agents.md index 86f6311c..3e8dc983 100644 --- a/agents.md +++ b/agents.md @@ -793,3 +793,8 @@ Existing PR #975 had no unresolved reviewer comments. Merged `master` into its b ## Run notes * 2026-10-27: The in-app API reference (`api-endpoints.ts`) now lists lessons and agents search. `api.md` mirrors both. Schedule validation and `schedule.tz` (ORIONIQ-1880) are documented in one line on the Schedule row of `create-agent.md`, since `POST` and `PUT /orioniq-be/agents` are not on the public API page. + +## Run notes + +* **2026-10-29:** Artemis #570 deleted the Marketplace preview and activation dialog ("All settings" included) and replaced it with the guided Review, Set up, and Done flow. Its notes live in `apps/orioniq/CLAUDE.md` under "Guided activation"; the file is about 250 KB, so fetch it to disk and read that section only. Artemis #575 made `POST /v2/orioniq-be/ai-agent/:agentId` return `404` for an agent the caller's account can't access. +* The existing agent PR is reused until it merges; its description is rewritten on every run. diff --git a/docs/user-guide/orioniq/api.md b/docs/user-guide/orioniq/api.md index 0915ca3d..e8616593 100644 --- a/docs/user-guide/orioniq/api.md +++ b/docs/user-guide/orioniq/api.md @@ -160,7 +160,7 @@ Fields you send override the matching fields in the agent's saved **Payload (JSO } ``` -A disabled agent returns `404`, unless its trigger type is Alert. When OrionIQ is temporarily shut down for maintenance, the endpoint returns `503`. +An agent that doesn't exist, or that your account can't access, returns `404`. A disabled agent also returns `404`, unless its trigger type is Alert. When OrionIQ is temporarily shut down for maintenance, the endpoint returns `503`. ## Get run status diff --git a/docs/user-guide/orioniq/marketplace.md b/docs/user-guide/orioniq/marketplace.md index 79485199..f5c3c6bd 100644 --- a/docs/user-guide/orioniq/marketplace.md +++ b/docs/user-guide/orioniq/marketplace.md @@ -53,40 +53,70 @@ It then checks live telemetry and reports the incident as resolved, contained, a ## Activate an agent template -To activate an agent template, click **View details** on its card, then click **Activate**. The preview turns into a short setup dialog, and the agent is created switched on. +Click a template card to open a three-step dialog: **Review**, **Set up**, and **Done**. The agent is created switched on when you finish **Set up**. -The template decides which sections the dialog shows. A section appears only when the template lets you change it. Anything hidden keeps the template's value. +### Review -| Section | What you set | +Review shows what the agent does before you commit: when it runs, what it produces, what data it needs, and its price per run. If the price can't be loaded, Review says so, and you can activate once it loads. + +Click **Set up agent** to continue. + +### Set up + +The template decides which fields appear. A field shows only when the template lets you change it. Anything hidden keeps the template's value. + +| Field | What you set | |---|---| -| **Trigger** | The trigger type and, for a scheduled agent, the schedule. | -| **Runbook** | Required when the template needs one, as for Incident Triage. The instructions for agents triggered by an API call, an alert, or a deployment. A scheduled agent shows its context message and run frequency instead. | -| **Output detail** | The template's level. Every current template starts at **Detailed**. | -| **Data sources** | The accounts the agent reads from. For an agent that reads logs, the account you are on is selected by default. | +| **Name** | Shown only when you already have agents from this template. It is prefilled, for example "Alert Digest 2". | +| **Runbook** | Required when the template needs one, as for Incident Triage. Shown for agents that run on demand. | +| **Data sources** | The accounts and connections the agent reads logs and metrics from. For an agent that reads logs, the account you are on is selected by default. | +| **Schedule** | For a scheduled agent: how often it repeats, the day, the hour, and the time zone. The next run is shown in the schedule's own zone. | +| **Send results to** | Who gets notified of the agent's results. | | **Integrations** | The integrations the agent can use. | -| **Notification recipients** | Who gets notified of the agent's results. | +| **Instructions** | The context message a scheduled agent runs with. | + +Data sources, Send results to, and Integrations open in a picker. Each selected item has a remove button. + +The side panel summarizes the agent, its expected runs, and its cost. On narrow screens the summary moves into the main column. -Data sources, Integrations, and Notification recipients appear as one-line summaries that expand in place. If something required is missing, such as a data source or a reconnected integration, the row opens so you can fix it. +Billing choices: + +* **After the free runs**: **Turn off** (the default) or **Keep running**, billed per run. If you can't see pricing, the choice is not offered. +* **Daily run limit**: For agents that run on demand, set the maximum runs a day. It starts at 5. Clear the box for no limit. + +Click **Activate agent**. If required fields are missing, the dialog lists how many need attention and moves you to the first one. If you close the dialog after changing the setup, OrionIQ asks before it discards your changes. Learning is off for agents activated from the Marketplace. You can turn it on later in the agent's **Agent details** form. See [Learning](/docs/user-guide/orioniq/create-agent/). -Click **All settings** to move your draft into the full agent form in the side panel, with everything you entered so far. The form offers only the fields the template lets you change, plus the name, description, and **Active**. Click **Show details** or **Hide details** to switch between the template description and the setup form. +### Done + +Done confirms the agent is active and shows what happens next: + +* **First run**: the next scheduled time, "When you start it", or "When an alert fires". +* **Free runs**: how many are left. +* **After free runs**: whether the agent turns off or keeps running at your price per run. +* **Daily limit**: shown for agents that run on demand. +* **Results**: the recipients, or the run history in Agents Hub. + +Click **Run a test** to start the agent once with sample input. It uses one of the free runs, or is billed at the price per run when the template has none. Results appear in the agent's run history in [Agents Hub](/docs/user-guide/orioniq/agents-hub/). If the test can't start because of a daily limit or budget cap, Done says which one. + +Done also offers one optional follow-up. A scheduled agent with no recipients offers **Add recipients**. An agent that runs on demand offers **Connect an alert**. -If you close the dialog after changing the setup, OrionIQ asks before it discards your changes. +The **What you set up** panel recaps your choices. To change them later, open the agent in Agents Hub. -After you click **Activate agent**, a confirmation shows how the agent runs. Click **Open in Agents Hub** to see the new agent in the [Agents Hub](/docs/user-guide/orioniq/agents-hub/), filtered to the template's agent type. +Click **Open in Agents Hub** to see the new agent, or **Done** to close the dialog. -You can activate a template more than once. Once agents exist for a template, its card and preview show the number of active agents. Click it to open the Agents Hub filtered to those agents. To switch an agent off, use the Agents Hub. +You can activate a template more than once. Once agents exist for a template, its card shows the number of active agents. Click it to open the Agents Hub filtered to those agents. To switch an agent off, use the Agents Hub. ## Free trial -Every agent you activate from the Marketplace starts with a free trial. The template card, the preview, the activation dialog, and the confirmation after you activate all show how many free runs the agent has. +Every agent you activate from the Marketplace starts with a free trial. The template card, the Review and Set up steps, and the Done step all show how many free runs the agent has. When the free runs are used, the agent switches off automatically and nothing is charged. In the [Agents Hub](/docs/user-guide/orioniq/agents-hub/), the **Cost** column shows the runs left, and an agent whose trial is over is marked **Trial ended**. Nothing runs or is charged until you turn it back on, and turning it on again asks you to confirm that each run is billed. -Template cards and previews show your account's own price per run. If the price can't be loaded, the price is left out and the free trial is still offered. +Template cards and the Review step show your account's own price per run. If the price can't be loaded, the price is left out and the free trial is still offered. -If you can see pricing, the activation dialog and the agent form also offer **Keep running after the free runs**. Select it to let the agent keep running, billed per run, once the trial ends. +If you can see pricing, Set up and the agent form also offer **Keep running** after the free runs. Select it to let the agent keep running, billed per run, once the trial ends. If a template you're interested in is not yet available, click **Add to Wish List** to signal your interest. This helps Logz.io prioritize which templates to build next.