diff --git a/agents.md b/agents.md index 6a37b9d6..4fe8bce5 100644 --- a/agents.md +++ b/agents.md @@ -711,3 +711,54 @@ No unresolved reviewer comments on the PR. No screenshots marked for documentati * `OIQ-AI-service`, `oiq-resources` - no commits. No unresolved reviewer comments on the PR. No screenshots marked for documentation use. Assignees unchanged. + +### 2026-10-14 - daily scan (since 2026-10-13 06:09), doc changes made + +* `Artemis` - #476 (Gavriel-M, ORIONIQ-1823): the `oiq-marketplace-free-trial` flag is removed, so the free trial is on for every account. Closes the open item from 2026-10-12. Added a **Free trial** section to `marketplace.md`. Source of wording: `AgentCommon/constants.ts` (`FREE_TRIAL_MESSAGES`) and `free-trial.util.ts`. The free run count and per-run price are template and Consul data, so the section does not quote them. + * #438 (yotamloe, ORIONIQ-1433, ORIONIQ-1772): agent memory, with a Memory **Agent docs** tab and a "Remember between runs" toggle in the agent editor. Not documented. Real memory still needs the per-account `oiq-agent-docs` flag and ai-service 3.12.0 in the region, so it is a staged rollout. Revisit when the flag is removed. `memory.md` stays accurate for account and user documents. + * #473 and #475 (Gavriel-M, ORIONIQ-1811): `GET /orioniq-be/integrations/connection-options` and an `agentConfig` body on `PUT /agents/alert/:alertId/rca`. Session routes for the Open 360 alert form. No gaia UI has merged yet, so nothing is customer-visible. Not part of the public `/v2` API, so `api.md` is unchanged. Revisit when the alert form change lands in `gaia-hermes-ws`. + * #464, #465 (galangel, ORIONIQ-1793): chat turn context as `turnContext` data. Internal. #478 and its revert #485: filter chip focus, net zero. #481, #479, #480, #482, #463: vendor and release chores. +* `OIQ-AI-service` - #520 (augment770-dev, ORIONIQ-1799): one default date and time format in answers. Prompt behavior, no route or schema change. #523: ECR image build workflow. No doc change. +* `gaia-hermes-ws` - #17196 and #17179 (Unified Dashboards, APPZ-3423 and APPZ-1937), #17191 (fake gateway for local dev). Out of OrionIQ scope. +* `oiq-resources` - no commits. + +### 2026-10-15 - daily scan (since 2026-10-14), doc changes made + +* `Artemis` - #369 (Gavriel-M, ORIONIQ-1683): new public `POST /v1/orioniq-be/agents/search`, gateway-authenticated with an API token, scoped to the token's own account, `pageSize` capped at 50. It is the first route of the **v1 public URL convention** (`/v1/orioniq-be/[/:id][/]`); the 12 existing `/v2` endpoints are frozen. Added **List agents** to `api.md`. Source of the field list: the PR body and `public.routes.ts`. Known gap in the endpoint: security-rule agents also show "Logz.io Alert" in `displayName`. + * #474, #488, #489 (RoyiSitbon): the structured RCA answer renders as a report in the invocation drawer, with stats, a pie chart and named investigators on the Analysis tab. Not documented: no verified copy for the report, and `agents-hub.md` describes the Output tab only in general terms. Revisit with the RCA v2 flag rollout. + * #487, #486: filter chip focus fix, RUM listener leak. Internal. +* `gaia-hermes-ws` - #17199, #17200 (Gavriel-M, ORIONIQ-1811): the alert and SIEM rule AI Analysis step gets a **Configure your agent** dialog (instructions, output detail, recipients) saved with the alert or rule. It retires the **Configure agent after saving** checkbox, and the hub link is now **Manage in Agents Hub**. Updated the three pages that described the old checkbox: both `configure-alerts-explore.md` twins and `manage-security-rules.md`. The dialog is behind the RCA v2 flag per the PR test plan, and the PR has no screenshots. + * #17207 (typed swagger, TypeScript bump), #17203 (Span Explorer), #17204 (Unified Dashboards legend): out of OrionIQ scope. +* `OIQ-AI-service` - #528, #522 (kevkle): RCA OIHV loop and deepagent telemetry domain. Internal runtime, no public route or schema change. +* `oiq-resources` - no commits. + +Existing PR #975 had no unresolved reviewer comments. No screenshots marked for documentation use. Assignees extended with the authors of the triggering commits. + +### 2026-10-16 - daily scan (since 2026-10-15 06:00), doc changes made + +* `Artemis` - #501 (Gavriel-M, ORIONIQ-1683): `POST /v1/orioniq-be/agents/search` now honors `sort` (first entry only; fields `name`, `type`, `active`, `createdAt`, `updatedAt`, `lastRun`; bad entry falls back to `createdAt` desc). Added the `sort` rows and example to **List agents** in `api.md`. Source: `agent-search-filters.ts` and the swagger constants. + * #492 (yotamloe, ORIONIQ-1841): agent builder takes its account from the session. Internal fix. #493 (RoyiSitbon): RCA report moved into `orion-chat`, still no verified copy. #498, #483: version packages. +* `gaia-hermes-ws` - #17217 (RoyiSitbon, ORIONIQ-1833): Open 360 drawer renders the RCA report and the onboarding survey is served by orioniq-be (`/orioniq-be/user-docs/survey`, session route). #17202, #17205, #17206, #17216 (Gavriel-M, ORIONIQ-1811, ORIONIQ-1830, ORIONIQ-1621): integrations picker and form-agnostic RCA agent setup modal, analytics events. Same RCA v2 flag as #17199 and #17200, no screenshots, not documented yet. #17211, #17212, #17214 (APPZ-3491): Swagger for other services, out of scope. +* `OIQ-AI-service` - #525, #521 (galangel): CI image tags and dev-namespace overrides. Internal. +* `oiq-resources` - #115 (Gavriel-M, ORIONIQ-1621): agent memory made configurable in marketplace templates. Still behind the `oiq-agent-docs` flag, not documented. Revisit when the flag is removed. + +Existing PR #975 had no unresolved reviewer comments. Appended to its branch. Gavriel-M, RoyiSitbon and galangel are the authors of triggering commits; vicmiletsky's commits were out of scope. + +### 2026-10-19 - daily scan (since 2026-10-18 06:00), no doc changes + +* `Artemis` - #494 (Gavriel-M, ORIONIQ-1621): agent memory now covers every agent except chat and Alert AI Analysis v1, on by default per run. Still shown only when `memoryAvailable` answers true, which needs the pod-mounted `oiq-agent-docs` flag. Not documented. Revisit when the flag is removed. +* `OIQ-AI-service` - #526 (augment770-dev, ORIONIQ-1827): Haiku 5.5 and named invocation profiles. #529 (yotamloe, ORIONIQ-1486): `@timestamp` rejected in aggregation tools. #532 (ralongit): agents may use the integration writes they hold. Internal runtime and prompt behavior, no public route or schema change. +* `oiq-resources` - #116 to #119 (ralongit, ORIONIQ-1377): fixes to the Alert Digest and Alert Tuning Report templates and the `logzio_api.md` skill (unified alert events filters, log-alert grouping by title, alert links by name). The six tuning patterns and the alert links already match the `marketplace.md` descriptions. No doc change. +* `gaia-hermes-ws` - no commits. + +Existing PR #975 had no unresolved reviewer comments and is approved. No screenshots marked for documentation use. Appended the log entry only. Assignees unchanged. + +### 2026-10-20 - daily scan (since 2026-10-19 06:00), doc changes made + +* `Artemis` - #512 (yotamloe, ORIONIQ-1858): feedback reflections are free. Price $0, no free-usage count, no AI budget check, still recorded as a $0 invocation. Removed the "$1 after 20 free" note in `create-agent.md`. + * #507 (ralongit, ORIONIQ-1850): Connect modal shows Agent permissions above How to connect and hides the auth-method tile for single-method integrations. `integrations.md` stays accurate. #495, #496 (Gavriel-M, ORIONIQ-1621): shared Memory files on an agent, still behind the memory flag, not documented. #508 (RoyiSitbon): RCA report tidy-up, still no verified copy. #503, #513, #514: internal. +* `oiq-resources` - 9a7ff36 (ralongit): `alert-tuning-report` and `scheduled-error-logs-report` moved from Summary to Detailed. Every template now ships Detailed, so `marketplace.md` says so instead of "Summary by default". +* `gaia-hermes-ws` (`master`) - #17208, #17221 (Gavriel-M, ORIONIQ-1830, 1849): the alerts list AI Analysis cell opens the RCA agent setup dialog directly. Not documented: `triggered-alerts.md` covers the triggered list, and no verified copy exists for the alert configuration list. #17209 (APPZ-3497): AI Observability drilldown, out of scope. +* `OIQ-AI-service` - #536, #527, #533 (kevkle, RoyiSitbon), #535, #534 (augment770-dev): RCA OIHV internals, model construction, smoke-test fake LLM. Internal. + +Existing PR #975 had no unresolved reviewer comments. Merged `master` into its branch (it was behind). No screenshots marked for documentation use. Assignees extended with yotamloe and ralongit. diff --git a/docs/open360/alerts/configure-alerts-explore.md b/docs/open360/alerts/configure-alerts-explore.md index bc13946f..46ae6ffe 100644 --- a/docs/open360/alerts/configure-alerts-explore.md +++ b/docs/open360/alerts/configure-alerts-explore.md @@ -216,7 +216,9 @@ Once triggered, the AI Agent will analyze related logs, metrics, and patterns. A #### Configure the agent -Enabling AI Agent Analysis creates an OrionIQ agent for the alert. Select **Configure agent after saving** to open it right after you save, or manage it later from the Agents Hub — the alert form links to it with **Manage in Agent Hub**. +Enabling AI Agent Analysis creates an OrionIQ agent for the alert when you save it. Select **Configure your agent** to set the agent's instructions, output detail (Summary or Detailed), and recipients. **Apply** adds your changes to the alert form, and they are saved with the alert. Turning AI Agent Analysis off and saving removes the agent and its settings. + +For full agent configuration, use **Manage in Agents Hub**, which opens the agent in the Agents Hub. The agent is editable like any other, so beyond the settings on this page you can: diff --git a/docs/user-guide/cloud-siem/security-rules/manage-security-rules.md b/docs/user-guide/cloud-siem/security-rules/manage-security-rules.md index 0b164538..ed1a0a0f 100644 --- a/docs/user-guide/cloud-siem/security-rules/manage-security-rules.md +++ b/docs/user-guide/cloud-siem/security-rules/manage-security-rules.md @@ -176,7 +176,9 @@ Every run is stored in the agent's invocation history, where you can read the fu #### Configure the agent -Turning the toggle on creates an OrionIQ agent for the rule, and you can update it at any time. Select **Configure agent after saving** to open it right after you save, or manage it later from the Agents Hub — the rule form links to it with **Manage in Agent Hub**. +Turning the toggle on creates an OrionIQ agent for the rule when you save it. Select **Configure your agent** to set the agent's instructions, output detail (Summary or Detailed), and recipients. **Apply** adds your changes to the rule form, and they are saved with the rule. Turning the toggle off and saving removes the agent and its settings. The button is disabled on protected rules and for read-only users. + +For full agent configuration, use **Manage in Agents Hub**, which opens the agent in the Agents Hub. The agent is editable like any other, so beyond the settings above you can: diff --git a/docs/user-guide/explore/explore-log-alerts/configure-alerts-explore.md b/docs/user-guide/explore/explore-log-alerts/configure-alerts-explore.md index 03e95e69..c32de99e 100644 --- a/docs/user-guide/explore/explore-log-alerts/configure-alerts-explore.md +++ b/docs/user-guide/explore/explore-log-alerts/configure-alerts-explore.md @@ -189,7 +189,9 @@ AI Agent Analysis runs **once every hour**. #### Configure the agent -Enabling AI Agent Analysis creates an OrionIQ agent for the alert. Select **Configure agent after saving** to open it right after you save, or manage it later from the Agents Hub — the alert form links to it with **Manage in Agent Hub**. +Enabling AI Agent Analysis creates an OrionIQ agent for the alert when you save it. Select **Configure your agent** to set the agent's instructions, output detail (Summary or Detailed), and recipients. **Apply** adds your changes to the alert form, and they are saved with the alert. Turning AI Agent Analysis off and saving removes the agent and its settings. + +For full agent configuration, use **Manage in Agents Hub**, which opens the agent in the Agents Hub. The agent is editable like any other, so beyond the settings on this page you can: diff --git a/docs/user-guide/orioniq/api.md b/docs/user-guide/orioniq/api.md index 958801da..f7a507f0 100644 --- a/docs/user-guide/orioniq/api.md +++ b/docs/user-guide/orioniq/api.md @@ -2,13 +2,13 @@ sidebar_position: 9 title: OrionIQ API image: https://dytvr9ot2sszz.cloudfront.net/logz-docs/social-assets/docs-social.jpg -description: Trigger OrionIQ agents, poll for results, send follow-ups, and submit feedback using the OrionIQ API. -keywords: [OrionIQ, API, agents, trigger agent, agent run, feedback, api token, automation] +description: List agents, trigger OrionIQ agents, poll for results, send follow-ups, and submit feedback using the OrionIQ API. +keywords: [OrionIQ, API, agents, list agents, agent ID, trigger agent, agent run, feedback, api token, automation] --- Agents configured with the **API** trigger run on demand when you call the OrionIQ API. Use it to start a run from a CI pipeline, an incident workflow, or any external system, then poll for the result. -To get an agent's ID and a ready-to-copy request for each endpoint, open the agent's actions menu in the [Agents Hub](/docs/user-guide/orioniq/agents-hub/) and select **API References**. +To get an agent's ID and a ready-to-copy request for each endpoint, open the agent's actions menu in the [Agents Hub](/docs/user-guide/orioniq/agents-hub/) and select **API References**. To look agents up with the API instead, use [List agents](#list-agents). ## Authentication @@ -34,6 +34,86 @@ If AI features are disabled for the account, [Run an agent](#run-an-agent) and [ If the account has reached its configured AI usage cap, [Run an agent](#run-an-agent) and [Send a follow-up](#send-a-follow-up) return `429` (`errorCode: "CAP_EXCEEDED"`). See [OrionIQ Settings → Capping](/docs/user-guide/orioniq/settings/#capping) for usage and budget limits. ::: +## List agents + +``` +POST /v1/orioniq-be/agents/search +``` + +Returns the agents in the token's account, so you can find an agent ID without opening the Agents Hub. Sub-account agents are not included. Listing starts no AI work, so it also works when AI features are disabled. + +### Sample request + +```shell +curl -X POST -L \ + https://<>/v1/orioniq-be/agents/search \ + -H 'Content-Type: application/json' \ + -H 'X-API-TOKEN: <>' \ + -d '{ + "filter": { + "searchTerm": "checkout", + "active": true + }, + "sort": [ + { + "field": "lastRun", + "descending": true + } + ], + "pagination": { + "pageNumber": 1, + "pageSize": 20 + } + }' +``` + +All fields are optional. A filter value the API cannot use is ignored. + +| Field | Description | +|---|---| +| `filter.searchTerm` | Returns agents whose title contains this text. | +| `filter.type` | Filters by agent type. | +| `filter.trigger` | Filters by trigger. An unknown value returns no results. | +| `filter.active` | `true` for enabled agents, `false` for disabled ones. | +| `filter.createdBy` | Filters by creator. | +| `sort` | A list where only the first entry is used. Each entry takes a `field` and an optional `descending` flag (default `false`). | +| `sort[].field` | One of `name`, `type`, `active`, `createdAt`, `updatedAt`, or `lastRun`. | +| `pagination.pageNumber` | The page to return. | +| `pagination.pageSize` | Results per page. Defaults to 50 and is capped at 50. | + +Results are ordered by creation time, newest first, unless you set `sort`. An unusable `sort` entry falls back to the default order. In ascending order, agents that never ran come first when sorting by `lastRun`. + +### Response + +```json +{ + "total": 1, + "results": [ + { + "id": "", + "name": "", + "displayName": "Checkout Latency Review", + "description": "Reviews latency on the checkout service.", + "type": "", + "trigger": "", + "active": true, + "isSystemAgent": false, + "createdAt": "2026-10-01T08:00:00Z", + "updatedAt": "2026-10-10T09:30:00Z", + "lastRun": "2026-10-14T06:00:00Z" + } + ], + "pagination": { + "pageNumber": 1, + "pageSize": 20 + } +} +``` + +`total` is the number of matching agents across all pages. A page past the end returns an empty `results` list. Use `displayName` as the agent's title. Each `id` works as `<>` in the other endpoints. + +A request authenticated with a session or share token instead of an API token returns `401`. + ## Run an agent ``` diff --git a/docs/user-guide/orioniq/create-agent.md b/docs/user-guide/orioniq/create-agent.md index a4304ed3..1d4e761d 100644 --- a/docs/user-guide/orioniq/create-agent.md +++ b/docs/user-guide/orioniq/create-agent.md @@ -119,7 +119,7 @@ Agents can learn from the feedback you leave on their invocations (see [Provide An agent can hold up to 20 active lessons at a time. As that limit gets close, a warning appears here; once it's reached, new feedback is acknowledged but produces no further lessons until you disable an existing one to make room. :::note -Writing a note is billed once it's accepted for review, whether or not it ends up teaching the agent anything: the first 20 reflections per account are free (all-time), then $1 each. +Writing a note is free. Each accepted note is still recorded as an invocation, at no cost, and it does not count against your AI budget. ::: ## Finalize and create diff --git a/docs/user-guide/orioniq/marketplace.md b/docs/user-guide/orioniq/marketplace.md index 2d7438eb..43260476 100644 --- a/docs/user-guide/orioniq/marketplace.md +++ b/docs/user-guide/orioniq/marketplace.md @@ -49,14 +49,14 @@ The template decides which sections the dialog shows. A section appears only whe |---|---| | **Trigger** | The trigger type and, for a scheduled agent, the schedule. | | **Runbook** | The instructions for agents triggered by an API call, an alert, or a deployment. A scheduled agent shows its context message and run frequency instead. | -| **Output detail** | **Summary** by default, unless the template sets a level. | +| **Output detail** | The template's level. Every current template starts at **Detailed**. | | **Data sources** | The accounts the agent reads from. For an agent that reads logs, the account you are on is selected by default. | | **Integrations** | The integrations the agent can use. | | **Notification recipients** | Who gets notified of the agent's results. | Data sources, Integrations, and Notification recipients appear as one-line summaries that expand in place. If something required is missing, such as a data source or a reconnected integration, the row opens so you can fix it. -Learning is off for agents activated from the Marketplace, because it is billed separately. You can turn it on later in the agent's **Agent details** form. See [Learning](/docs/user-guide/orioniq/create-agent/). +Learning is off for agents activated from the Marketplace. You can turn it on later in the agent's **Agent details** form. See [Learning](/docs/user-guide/orioniq/create-agent/). Click **All settings** to move your draft into the full agent form in the side panel, with everything you entered so far. Click **Show details** or **Hide details** to switch between the template description and the setup form. @@ -66,6 +66,14 @@ After you click **Activate agent**, a confirmation shows how the agent runs. Cli You can activate a template more than once. Once agents exist for a template, its card and preview show the number of active agents. Click it to open the Agents Hub filtered to those agents. To switch an agent off, use the Agents Hub. +## Free trial + +Every agent you activate from the Marketplace starts with a free trial. The template card, the preview, the activation dialog, and the confirmation after you activate all show how many free runs the agent has. + +When the free runs are used, the agent switches off automatically and nothing is charged. In the [Agents Hub](/docs/user-guide/orioniq/agents-hub/), the **Cost** column shows the runs left, and an agent whose trial is over is marked **Trial ended**. Nothing runs or is charged until you turn it back on, and turning it on again asks you to confirm that each run is billed. + +If you can see pricing, the activation dialog and the agent form also offer **Keep running after the free runs**. Select it to let the agent keep running, billed per run, once the trial ends. + If a template you're interested in is not yet available, click **Add to Wish List** to signal your interest. This helps Logz.io prioritize which templates to build next. You can also click **+ Create New Agent** in the top right corner to build a custom agent from scratch.