If you’ve ever troubleshot a complex workflow run, you know the drill: click into actions, expand inputs and outputs, scan logs, backtrack, repeat. When something goes wrong, the signal is there, but it’s buried under a lot of execution detail.
Today, we’re changing that.
We’ve just released Workflow Run Summaries in Cisco XDR Automate: an on-demand, AI-generated summary that explains what happened during a workflow execution, where things went wrong, and why that matters, without forcing you to manually inspect every step. It even provides you with potential remediation steps to fix your mistakes.
What the feature does
With a single click on “Generate Run Summary”, Cisco XDR Automate analyzes a completed workflow run and produces a concise, human-readable explanation of its execution. This includes:
- The overall outcome of the run
- Key actions that succeeded or failed
- Errors, misconfigurations, or missing outputs that impacted downstream steps
- Context on why a failure occurred, not just where
- In case a Workflow Run failed: it provided remediation steps!
The goal is simple: help you understand the run in seconds, not minutes.
Not just “dump it into an LLM”
Under the hood, this feature combines Cisco managed AI models with deterministic heuristics and structured pre-processing. We intentionally avoid sending raw execution noise straight to a large language model.
Instead, we:
- Classify actions and outcomes
- Filter and normalize relevant signals
- Identify error patterns and execution gaps
- Then generate a summary grounded in the actual workflow semantics
This approach makes the output more reliable, more consistent, and far more useful when troubleshooting real automation logic.
This work was done in collaboration with Cisco Outshift, Cisco’s incubation engine. Their AI and ML experts helped us do extensive research into a variety of AI-based features that are now on our horizon, of which the AI Run Summaries are the first to be released.
Why this matters, especially for Agentic AI
As XDR Automate Workflows are increasingly triggered by Agentic AI, clarity becomes non-negotiable. Humans don’t always catch subtle failures. Output variables may not be set. Assumptions break silently.
Run Summaries make workflow execution transparent and auditable, which is a prerequisite for trust, both for human operators and for AI Agents that depend on workflow outputs.
In this first iteration, summaries are generated on demand. Looking ahead, our direction will move towards automatically summarizing Agentic AI-invoked workflow runs and feed those summaries back into the AI itself. That’s how you close the loop.
What’s next
This feature is now live and marks the start of a broader set of out-of-the-box AI capabilities in Cisco XDR Automate (capabilities that will obviously also extend into Cisco Meraki Workflows).
Less clicking. Fewer blind spots. More confidence that your automation is doing exactly what you think it is.
And when it doesn’t? Now it can explain itself.
We’d love to hear what you think! Ask a question and stay connected with Cisco Security on social media.
Cisco Security Social Media
