SlackAskV2 returning answers but did not provide a field in Context Data

[EDzuhri]

Hello,

I am new to using XSOAR and wanted to develop a playbook that sends a confirmation whether the user clicked a phishing link or not. I tried to use SlackAskV2 which did its job by sending a message to either user or channel and returning the given answer back to XSOAR in War Room.

The issue that I encounter is, I don't see any context data being listed in the user response hence unable to use the answer as the next step for conditional tasks.

Can anybody enlighten me on this particular issue? any ideas, suggestions, or alternatives are very much appreciated.

Thanks!

[sramesh-7 · Accepted solution]

Hi, 

After the SlackAskV2 task and the manual task which closes one the response is received, use a task with automation commentstocontext with entryid as ${lastCompletedTaskEntries.[0]} and any key you want to store the response , this will add the response to context

[EDzuhri]

Hi Sramesh,

Thank you for your response. I think this could be the solution to my problem. However, could you elaborate on how to postpone the SlackAskV2 task to close only after XSOAR received the answer from Slack (users) so I can accurately transform the answer coming from a user (comment) to Context data?

The reason being is I tried to use the solution you mention above but the SlackAskV2 task closes immediately. Thus, the comment that was added to the Context is the completion comment of the SlackAskV2 task (example: Message sent to Slack successfully. Thread ID is: 1668477714.281879).

Many thanks!

[EDzuhri]

Hi Sramesh,

Please ignore my follow-up question above. I've found the solution to that using the argument Task in SlackAskV2 which will complete the next task that I crafted to be kept open until a response from the user is received.

Thank you very much for your help!

[ialonso]

Hi EDzuhri, could you give a more detailed example of how you were able to acomplish this?. I've tried everything but I still getting the " Message sent to Slack successfully. Thread ID is: 1668477714.281879" as the output to my new key. It seems like the Task parameter is not working, as it doesn't wait until the response to close the task.

Thanks in advance

[asawyer]

@ialonso make sure you put a Manual task directly after SlackAskV2, before commentsToContext. That is what pauses the playbook execution until the Slack response is received by XSOAR.

[EDzuhri]

Plus one on @asawyer answer. It should be something like the attached image below.

[GWynn]

Hello all, I can't seem to get this working either. I have followed the process but no luck.Also it appears this integration does not return anything to context, so here we are trying for a work-around which appears to have worked for some people. I have attached some screenshots below. The last task, whilst closed, is still error-ing as per screenshot.

[GWynn]

OK update to this, If I answer YES or NO in the manual task it works but just how do I know (without looking at the WarRoom what the answer was??)

[asawyer]

@GWynn you can use a conditional task to take a different path depending on what the answer is. Please watch this video to see how this approach works: https://live.paloaltonetworks.com/t5/cortex-xsoar-how-to-videos/cortex-xsoar-how-to-video-slackaskv2... 

[GWynn]

Hello @asawyer thanks for this. I will give it a watch, I have already figured it out I think but this video will also help! Thanks! Geoff

[assubramania]

Hi team,

My Slack v3 integration is working in Dev and Prod. They are in the latest version 3.2.4. I couldn't able to edit the message of users in Prod but it is working in Dev. Please someone assist soon.