Topic
This article describes how to use Katana AI recipes to speed up your workflow.
Environment
NinjaOne Katana Agentic AI
Description
In Katana AI, a recipe is a predefined playbook that tells Katana how to answer one specific kind of question about your NinjaOne environment.
Katana can determine on its own which data to pull. But recipes tell Katana what to look up and how to handle the results, so the same question gets the same structured analysis and response each time.
Katana currently ships with 10 pre-loaded recipes. We provide examples of three of them below. Importing your own custom recipes is a planned future feature of Katana AI.
How a Recipe Works
Each recipe has four parts:
- When it applies: Trigger phrases and example questions, like “What’s wrong with this device?” or “Help me resolve this ticket,” so Katana knows which recipe fits.
- Inputs: What Katana needs, such as a device, organization, or ticket ID. On a device page, customer dashboard, or ticket page, it takes the ID from the page. Otherwise, it looks up the ID from the name you gave.
- Steps: An ordered list of lookups against NinjaOne data, such as device health, alerts, patches, disk volumes, ticket history, and similar tickets. Each step says what to pull out, and later steps can build on earlier ones. A recipe can also stop early. For example, if a device is healthy, Katana says so instead of inventing problems.
- Answer shape: What the response must include, such as likely causes with the evidence behind each, ranked devices with reasons, or resolution steps. It also says what Katana didn’t check.
Recipes also carry the following guardrails:
- Katana recommends scripts but never runs them.
- Ticket recipes are read-only unless you ask Katana to change something.
- Katana uses the same device, organization, or ticket ID in every step.
- Katana displays device names appear exactly as NinjaOne returns them.
Recipe Examples
To get an idea of how recipes work, click the links below for descriptions and examples for three of the 10 available recipes.
- Device Health Diagnosis
- Devices Needing Attention in an Organization
- Ticket Resolution with Device Context
Device Health Diagnosis
Use this recipe when: you ask what’s wrong with one device, why it’s slow or unhealthy, or whether it needs attention.
Input: the device ID. It’s taken from the device page, or looked up by name if you ask from elsewhere.
What Katana checks:
- Health summary: The device’s health score and scored issues, with category, severity, and description.
- Device details: Display name, organization, last check-in, and whether it’s offline.
- Active alerts: Up to 25 alerts firing on the device, newest first.
- OS patches: Failed patches first, then pending and rejected ones, with names and severities.
- Disk space: Any volume with less than approximately 10% free.
- Causes: Katana lists up to three likely causes, ranked by severity. Each needs evidence from at least one earlier step.
- Scripts: Recommended scripts for the top cause.
Early stop: if the device has no issues, alerts, outstanding patches, or low disks, Katana says it’s healthy and gives the score.
Answer includes: device name, health score, and online status. It also lists likely causes, with the alert, patch, or volume behind each; suggests scripts with next steps; and notes anything it didn’t check, such as installed software or event logs.
Guardrail: scripts are suggestions only. Katana never runs them.
Example prompts:
- “What’s wrong with DESKTOP-4821?”
- “Why is the finance team’s file server so slow today?”
- “Run a health check on Sarah’s laptop and suggest any scripts that might help.“
Devices Needing Attention in an Organization
Use this recipe when: you ask which devices in an organization are unhealthy, need attention, or should be addressed first.
Inputs: the organization ID, from the customer dashboard or looked up by name, and an optional list of statuses. The default is UNHEALTHY and NEEDS_ATTENTION.
What Katana checks:
- Health status: one query per status, up to 50 devices each, returning name, status, operating system (OS), and location.
- Alerts: critical and major alerts firing now, grouped by device.
- Patches: patches pending approval, with counts per device and the most severe.
- Ranking: up to 10 devices listed in order of severity. An unhealthy status, a critical alert, or many severe pending patches each push a device higher on the list.
Answer includes: How many devices are unhealthy and how many need attention, then the ranked devices with reasons and what to look at first.
Important to Know:
- Alerts cover only what’s firing now.
- Device names appear exactly as returned.
Example prompts:
- “Which devices at Acme Corp need attention?”
- “What’s unhealthy for Contoso right now?”
- “Show me only the unhealthy devices at Globex.” This prompt sets the statuses to UNHEALTHY only.
Ticket Resolution with Device Context
Use this recipe when: you ask how to resolve, troubleshoot, or respond to a specific ticket, or what’s going on with it.
Input: the ticket ID, from the ticket page or from your question.
What Katana checks:
- Ticket: Subject, description, status and priority, plus the linked device if there are any.
- History: Log entries, oldest first, to see what’s been tried and the latest customer reply.
- Device health: The linked device’s health score and any issues that could explain the ticket. Katana skips this if the ticket has no associated device.
- Similar tickets: The closest resolved tickets and what fixed them.
- Recommended solution: The suggested resolution steps.
Answer includes:
- A two-to-three sentence summary of the ticket and what’s been tried.
- Relevant device findings, or a note that there’s no device.
- Resolution steps, flagging which match how similar tickets were fixed.
- Open questions to ask the customer.
Guardrail: read-only. Katana won’t comment on, update, or close the ticket unless you ask.
Example prompts:
- “Help me resolve ticket 1452.”
- “What’s going on with ticket 3307, and what’s the fix?”
- “Has anyone solved something like ticket 2218 before?”
List of Currently Available Pre-loaded Recipes
The table below lists all the current recipes and trigger words you can use to run them.
| Recipe | Trigger words |
|---|---|
| Find Failed Activities | what failed recently; show me failed activities; where are the failures; failed scripts or automations; what activities failed on this device |
| Find Devices by OS, Group, or Tag | which devices run Windows; devices in this group; devices with this tag; list devices by operating system; how many devices are on this os |
| Organization Patch Status | patch status for this organization; what patches are pending; failed patches; optimize patch management; patching best practices |
| Organization Security Posture | security posture for this organization; is this organization protected; threats at this organization; unencrypted devices; known exploited vulnerabilities |
| How to Configure a Feature | where do i configure; how do i set up; where can i change this setting; steps for onboarding a new organization; how to enable |
| Device Custom Field Values | custom field value; custom fields for this device; what is the custom field set to; devices with this custom field |
| Device Health Diagnosis | is this device healthy; what is wrong with this device; why is this device slow; diagnose this device; device health check |
| Devices Needing Attention | which devices need attention; unhealthy devices for this organization; devices that need attention |
| Ticket Resolution Helper | help me resolve this ticket; how do i fix this ticket; troubleshoot this ticket; what should i do with this ticket |
| Installed Software on Specific Devices | software installed on this device; what software is installed on; is this software installed; software version on this device; installed software version; which of these devices have |
Additional Resources
For more information about NinjaOne Katana Agentic AI, refer to NinjaOne Katana Agentic AI: Getting Started.