I need to automate customer follow ups using XSOAR. My requirements are as below.
I'm stuck on the last two steps, I was thinking of using email communication content pack. But that seems to require manual reply from the incident, not fully automated.
Very grateful if someone has insight into this.
Thank you for the response, I already have few data collection tasks. But here what I need to take away is following up in emails as a reply according to the SLA. As an example if I have an email saying
Incident on XXX.
XSOAR will send a reply to that email in 3 days
If someone reply to that Analyst will take over the Ticket. Until then Dbot will handle replies.
OK, so for this it sounds like you'll want to use pieces out of the Email Communication pack.
When using the SendEmailReply automation (instead of just send-mail), this includes a thread ID in the message. The PreprocessEmail script from the same pack is configured as a Pre-Process Rule will then look for this thread ID on new incoming emails and where it finds one, match it with an existing incident and update that incident with the new information.
In your case, it sounds like instead of (or as well as) updating the incident, you want to change the owner of the original incident or notify an analyst or something similar. You'd need to extend the PreprocessEmail script for this extra part.
Whereas in the default Email Communications pack use case the SendEmailReply command would be executed by an analyst using a layout/button, you'll want to run SendEmailReply from the playbook automatically.
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!
The LIVEcommunity thanks you for your participation!