# Scheduled AI Prompts (Beta)

## Overview

{% hint style="info" %}
Scheduled AI prompts are in open beta starting with Panther version 1.120 and is available to all customers. Please share any bug reports and feature requests with your Panther support team.
{% endhint %}

Scheduled AI prompts allow you to automate recurring AI-powered security analyses on a defined schedule. Instead of manually asking Panther AI to triage alerts, summarize security posture, or analyze alert queues, you can configure prompts that run automatically and produce AI conversations with findings.

## Create a scheduled prompt

To create a scheduled prompt:

1. In the left-hand navigation bar of your Panther Console, click **Panther AI** > **Scheduled Prompts.**
2. In the upper-right corner, click the **+** button.
3. Fill out the following fields:
   * **Name**: A descriptive name for your prompt (max 256 characters).
   * **Prompt**: The question or instruction for the AI (max 10,000 characters).
   * **Schedule**: Configure either:
     * **Rate (Periodic)**: Run at fixed time interval (minimum 5 minutes).
     * **Cron Expression**: Run at specific dates and times using [Cron expressions](https://docs.panther.com/search/scheduled-searches#how-to-use-the-scheduled-search-crontab) (minimum 5 minutes).
   * **Run As** (Optional): If you have the **AI Run As** permission, you can specify a different user account or API token whose permissions the AI will execute. If left blank, the prompt will run with your permissions.
   * **Enable on creation**: Toggle `ON` for the prompt to run on its configured schedule. Defaults to `ON`.
4. Click **Create** to save your scheduled prompt.

{% hint style="warning" %}
**Scheduled prompt permissions**

**By default, scheduled prompts run with the creator's permissions.** However, administrators with the **AI Run As** permission can configure a prompt to run as a specific user or API token instead. The AI uses the same data access, tool permissions, and role restrictions as the configured run-as user. This means:

* The prompt can only access log types, alerts, and detections that the run-as user's (or creator's) role permits.
* If the run-as user's (or creator's) role permissions are later reduced, the prompt's capabilities are reduced accordingly — it will no longer be able to access data or perform actions beyond the updated permissions.
* If the run-as user's (or creator's) account is deleted or disabled, the prompt is automatically disabled and marked as failed.
* There is a limit of 100 scheduled prompts per user.
  {% endhint %}

<figure><img src="https://4011785613-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-LgdiSWdyJcXPahGi9Rs-2910905616%2Fuploads%2FnIHXvukmlG9DbR9AFC28%2FScreenshot%202026-03-13%20at%2011.20.50%E2%80%AFAM.png?alt=media&#x26;token=d2517131-ef5f-452f-88e8-7e10a9c0986c" alt="" width="563"><figcaption></figcaption></figure>

## View scheduled prompt results

To view the results of a scheduled prompt run:

1. In the left-hand navigation bar of your Panther Console, click **Panther AI** > **Scheduled Prompts**.
2. Click the name of a scheduled prompt to open its detail page.
3. The detail page displays the AI response from the most recent run. Click the **Open in full screen** icon to open the conversation in the Panther AI view.

<figure><img src="https://4011785613-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-LgdiSWdyJcXPahGi9Rs-2910905616%2Fuploads%2FRtArPKW9Xn7zGGrAIM1x%2FScreenshot%202026-03-13%20at%2011.38.17%E2%80%AFAM.png?alt=media&#x26;token=d7d51b1e-13f9-4dca-b0c6-5ac2bb92e9f5" alt=""><figcaption></figcaption></figure>

The detail page also displays the following run information:

* **Status** — Whether the prompt is currently `ACTIVE` or `DISABLED`.
* **Schedule** — The configured run frequency.
* **Next Run** — The next scheduled execution time (only shown when the prompt is enabled).
* **Last Run** — The scheduled time of the most recent execution and its status: `SUCCEEDED`, `FAILED`, or `RUNNING`.
* **Errors** — If the most recent run failed, a description of the error is displayed below the run status.

If the prompt has not yet executed, the detail page displays the next scheduled run time.

## Manage scheduled prompts

### Edit a scheduled prompt

1. Navigate to **Panther AI** > **Scheduled Prompts**.
2. To open the edit modal, do one of the following:
   * On the prompt card, click the **⋯** menu > **Edit**.
   * On the prompt detail page, click **Edit**.
3. Update the desired fields and click **Update**.

### Enable or disable a scheduled prompt

A disabled prompt is saved but does not run until re-enabled. To enable or disable a prompt:

* On the prompt card, use the toggle switch on the right side of the card.
* On the prompt detail page, use the toggle switch in the page header.

### Delete a scheduled prompt

1. To open the delete confirmation, do one of the following:
   * On the prompt card, click the **⋯** menu > **Delete**.
   * On the prompt detail page, click **Delete**.
2. Confirm the deletion. The prompt is immediately removed from the schedule.


---

# Agent Instructions: Querying This Documentation

If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter:

```
GET https://docs.panther.com/ai/scheduled-ai-prompts.md?ask=<question>
```

The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.