Not every job needs a workflow first. When an alert lands, an auditor asks for evidence or a manager needs an answer today, open Optimus, describe the job and let the agents do the legwork with your tools. If the job turns out to be one you'll repeat, turn it into a workflow or a harness from the same conversation.
This guide covers ad-hoc work. To build automations, see Build with AI Builder and Optimus.
Before you start
- A model. Optimus uses the model selected in its AI Model settings. See Connect your AI models.
- The tools it may use. Optimus can only call the integrations, actions and workflows you enable under Tools. Connect the tools first under Integrations.
- Optional context. Add Knowledge (policies, runbooks), Memory (memory spaces with past findings or asset data) and Skills (how your team does a job) so answers reflect your environment.
Configure Optimus
Click Optimus next to the autobotAI logo in the top bar. Its settings panel has these tabs:
| Tab | What you set |
|---|---|
| AI Model | The provider, account and model Optimus uses. |
| Behavior & Persona | Instructions: its role, house rules, tone and boundaries. |
| Knowledge | Reference material it can search, such as policies and runbooks. |
| Memory | The memory spaces it can recall from and add to. |
| Skills | The skills, and versions, it can apply. |
| Tools | What it may call: library actions, no-code actions, Python actions and MCP servers, per integration. |
Start narrow. Give Optimus read-only tools for investigation, and add actions that change things only when you also have approvals in place.
Run an investigation
- Describe the job and the outcome you want. Include what you already know, for example: "j.doe signed in from Lisbon 40 minutes after Bengaluru. Check sign-in history, devices and recent privileged actions, and tell me whether this is real."
- Watch the plan. Optimus breaks the job into steps and shows its to-do list as it works. Larger jobs are split across sub-agents, each with its own task.
- Answer its questions. When it needs a decision or a missing detail (which account, which time window, whether to proceed) it asks you in the conversation with a short form, and waits.
- Approve what it needs. If a step needs a capability it doesn't have, such as an integration or action that isn't enabled, it asks you to enable it rather than working around the gap.
- Review the evidence. Tool calls, results and any files it produces appear in the conversation and its artifacts panel, so you can check every step before you act on the answer.
Use a long-running session for work that takes longer than a conversation, such as a broad hunt across many accounts. The agents keep working and report back in the same thread.
Good ad-hoc jobs
| Team | Ask Optimus to |
|---|---|
| SOC | Triage this alert, correlate the logs and suggest containment |
| SOC | Sweep the environment for the indicators in this advisory |
| Identity | Explain why this user has admin on the payments account, and who approved it |
| GRC | Collect evidence for control CC6.1 and draft the auditor's note |
| Cloud | Find public storage buckets and who owns each one |
| AppSec | Summarize open critical findings for checkout-service and who owns each fix |
| Detection | Write a detection rule from this attacker behavior and back-test it |
Act safely
Optimus works inside the same guardrails as every agent:
- It can only reach the tools you enabled, with the permissions each integration has.
- Actions that need approval wait for a named approver, whoever asked for them.
- Every plan step, tool call and result is recorded in the execution history and audit trail.
For tests against your own applications, use an offensive security scan, which only targets domains you have verified, repositories and internal targets you select.
Turn it into an automation
If you'll need the same job again, ask Optimus to turn it into one:
- A workflow when the steps are now known: for example, run this triage every time the SIEM raises this alert type.
- A harness when the outcome spans many runs and owners: for example, keep this application free of exploitable findings.
See Choosing a workflow or a harness, then Build with AI Builder and Optimus.