# Scheduled AI Prompts (Beta)

## Overview

{% hint style="info" %}
Scheduled AI prompts are in open beta starting with Panther version 1.120 and is available to all customers. Please share any bug reports and feature requests with your Panther support team.
{% endhint %}

Scheduled AI prompts allow you to automate recurring AI-powered security analyses on a defined schedule. Instead of manually asking Panther AI to triage alerts, summarize security posture, or analyze alert queues, you can configure prompts that run automatically and produce AI conversations with findings.

## Create a scheduled prompt

To create a scheduled prompt:

1. In the left-hand navigation bar of your Panther Console, click **Panther AI** > **Scheduled Prompts.**
2. In the upper-right corner, click the **+** button.
3. Fill out the following fields:
   * **Name**: A descriptive name for your prompt (max 256 characters).
   * **Prompt**: The question or instruction for the AI (max 10,000 characters).
   * **Schedule**: Configure either:
     * **Rate (Periodic)**: Run at fixed time interval (minimum 5 minutes).
     * **Cron Expression**: Run at specific dates and times using [Cron expressions](https://docs.panther.com/search/scheduled-searches#how-to-use-the-scheduled-search-crontab) (minimum 5 minutes).
   * **Enable on creation**: Toggle `ON` for the prompt to run on its configured schedule. Defaults to `ON`.
4. Click **Create** to save your scheduled prompt.

{% hint style="warning" %}
**Scheduled prompt permissions**

**Scheduled prompts run with the creator's permissions.** The AI uses the same data access, tool permissions, and role restrictions as the user who created the prompt. This means:

* The prompt can only access log types, alerts, and detections that the creator's role permits.
* If the creator's role permissions are later reduced, the prompt's capabilities are reduced accordingly — it will no longer be able to access data or perform actions beyond the creator's updated permissions.
* If the creator's account is deleted or disabled, the prompt is automatically disabled and marked as failed.
* There is a limit of 100 scheduled prompts per user.
  {% endhint %}

<figure><img src="https://4011785613-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-LgdiSWdyJcXPahGi9Rs-2910905616%2Fuploads%2FnIHXvukmlG9DbR9AFC28%2FScreenshot%202026-03-13%20at%2011.20.50%E2%80%AFAM.png?alt=media&#x26;token=d2517131-ef5f-452f-88e8-7e10a9c0986c" alt="" width="563"><figcaption></figcaption></figure>

## View scheduled prompt results

To view the results of a scheduled prompt run:

1. In the left-hand navigation bar of your Panther Console, click **Panther AI** > **Scheduled Prompts**.
2. Click the name of a scheduled prompt to open its detail page.
3. The detail page displays the AI response from the most recent run. Click the **Open in full screen** icon to open the conversation in the Panther AI view.

<figure><img src="https://4011785613-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-LgdiSWdyJcXPahGi9Rs-2910905616%2Fuploads%2FRtArPKW9Xn7zGGrAIM1x%2FScreenshot%202026-03-13%20at%2011.38.17%E2%80%AFAM.png?alt=media&#x26;token=d7d51b1e-13f9-4dca-b0c6-5ac2bb92e9f5" alt=""><figcaption></figcaption></figure>

The detail page also displays the following run information:

* **Status** — Whether the prompt is currently `ACTIVE` or `DISABLED`.
* **Schedule** — The configured run frequency.
* **Next Run** — The next scheduled execution time (only shown when the prompt is enabled).
* **Last Run** — The scheduled time of the most recent execution and its status: `SUCCEEDED`, `FAILED`, or `RUNNING`.
* **Errors** — If the most recent run failed, a description of the error is displayed below the run status.

If the prompt has not yet executed, the detail page displays the next scheduled run time.

## Manage scheduled prompts

### Edit a scheduled prompt

1. Navigate to **Panther AI** > **Scheduled Prompts**.
2. To open the edit modal, do one of the following:
   * On the prompt card, click the **⋯** menu > **Edit**.
   * On the prompt detail page, click **Edit**.
3. Update the desired fields and click **Update**.

### Enable or disable a scheduled prompt

A disabled prompt is saved but does not run until re-enabled. To enable or disable a prompt:

* On the prompt card, use the toggle switch on the right side of the card.
* On the prompt detail page, use the toggle switch in the page header.

### Delete a scheduled prompt

1. To open the delete confirmation, do one of the following:
   * On the prompt card, click the **⋯** menu > **Delete**.
   * On the prompt detail page, click **Delete**.
2. Confirm the deletion. The prompt is immediately removed from the schedule.