Create an Ask task - Administrator Guide - Cortex XSIAM - Cortex - Security Operations

Cortex XSIAM Administrator Guide

Cortex XSIAM
Creation date
Last date published
Administrator Guide

Create a conditional Ask task in a playbook. An Ask task is a single question survey that determines how the playbook proceeds. Answer is recorded in context.

The Conditional Ask task is a single question survey, the answer to which determines how a playbook proceeds. If you send the survey to multiple users, the first answer received is used, and subsequent responses are disregarded.

When creating an ask task, there are several tabs where you can enter values. Some configurations are required, and some are optional. Click each tab for detailed information.

If the playbook was installed from a Content Pack, duplicate or detach the playbook, before creating an ask task.

  1. In a playbook, click +.

  2. Select the Conditional option.

  3. Enter a meaningful name for the task, which corresponds to the data that you are collecting. For example, Was the Alert escalated?.

  4. Select the Ask option.

  5. Select the communication options you want to use to collect the data.

    • The Task option is selected by default. The data collection survey can be completed directly in the workplan.

    • If you select Generated link, a link to the data collection survey is available in the context data of the task.

    • If you select Email, enter the subject and message of the email and the email addresses of the users who should receive this message or survey.

    • Some integrations can be used to collect data for Ask Tasks, such as Microsoft Teams and Slack. If any of these integrations are installed, it will appear as an option.

  6. (Optional) To customize the look and feel of your email message, click Preview.

    You can change the color scheme and how test in the message header and body appear.