Create an Ask Task - Administrator Guide - 6.10 - Cortex XSOAR - Cortex - Security Operations

Cortex XSOAR Administrator Guide

Cortex XSOAR
Creation date
Last date published
Administrator Guide

Create a conditional Ask task in a playbook. An Ask task is a single question survey that determines how the playbook proceeds. Answer is recorded in context.

The conditional ask task is a single question survey, the answer to which determines how a playbook proceeds. If you send the survey to multiple users, the first answer received is used, and subsequent responses are disregarded.

When creating an ask task, there are several tabs where you can enter values. Some configurations are required, and some are optional. Click each tab for detailed information.

If the playbook was installed from a content pack, duplicate or detach the playbook, before creating an ask task.

If you want to view the link generated by the task in the Incident's Context Data, you must first make the links visible., By default, these links are hidden. To make the links visible, add the comm.ask.linktocontext.enabled server configuration set to true. The links appear under Ask.Links in the Context Data.

  1. In a playbook, click + (Create task).

  2. Select the Conditional option.

  3. Enter a meaningful name for the task, which corresponds to the data that you are collecting. For example, Was the Incident escalated?

  4. Select the Ask option.

  5. (Optional) To customize the look and feel of your email message, click Preview.

    You can change the color scheme and how text in the message header and body appear.