topic Re: Using Await for an email only for expected answers in Cortex XSOAR Discussions

Using Await for an email only for expected answers

Josep — Thu, 06 Oct 2022 10:08:44 GMT

Hello,

I'm sending an email to the users and I wait for 3 possible answers. However, sometimes the users are outside the office and I receive and automatic answer. How can avoid this, and only wait for the 3 possible ones.

Re: Using Await for an email only for expected answers

michaelsysec242 — Tue, 25 Oct 2022 11:07:23 GMT

@Josep As far as I know you can't take into account the the Auto-Reply emails. You could use either Data-Collection task or an ask task. These are in-built features that allow you to ask a question with clickable answers such as "Yes" and "No" etc. I don't believe that an email reply will close the task and carry on in the playbook. A data-collection task will require the recipient to enter a secure link that has a basic questionnaire. You decide the question and even one is enough, the task will not continue until a reply is received or a deadline (SLA) is breached. The primary disadvantages of this is that the recipient will need to have a way to communicate with the XSOAR on the network or you could use an engine. In any case let me know if this helps.

Re: Using Await for an email only for expected answers

Josep — Tue, 25 Oct 2022 11:26:02 GMT

Thanks for the reply,

Finally I made it work just filtering the email users if they are outside the office. So before sending the "EmailAskUser" I choose which of them is available to answer.

About this "I don't believe that an email reply will close the task and carry on in the playbook", yes, it does. Just using the "task" option in "EmailAskUser" and configuring the next task with this variable in "details"

Re: Using Await for an email only for expected answers

Josep — Tue, 25 Oct 2022 11:28:12 GMT

https://live.paloaltonetworks.com/t5/cortex-xsoar-discussions/need-a-time-limit-for-emailaskuser-task/m-p/508462#M1036 here it is how to wait for the answer.

Re: Using Await for an email only for expected answers

michaelsysec242 — Tue, 25 Oct 2022 12:08:56 GMT

Re: Using Await for an email only for expected answers

michaelsysec242 — Tue, 25 Oct 2022 12:09:22 GMT

@Josep , Interesting concept and solution !

I thought you intended to use the "Ask" task instead. This way enay emails returned to the server will not affect the status of the currently running task. The ask task will appear as Yellow in colour and will be pending until the recipient answers. Let me know if this helps ?

Re: Using Await for an email only for expected answers

Josep — Tue, 25 Oct 2022 12:21:57 GMT

"Ask" option is quite limited. So I had to use the system automation "EmailAskUser" to solve it. My fault I didn't explain it well 😅