Communication Tasks - Administrator Guide - 6.9 - Cortex XSOAR - Cortex - Security Operations

Cortex XSOAR Administrator Guide

Cortex XSOAR
Creation date
Last date published
Administrator Guide

Communication tasks in Cortex XSOAR playbooks enable you to send surveys and collect data.

Communication tasks enable you to send surveys internally and externally to users to collect data for an incident. The collected data can be used for incident analysis, and as input for subsequent playbook tasks. For example, you may want to send a scheduled survey requesting analysts to send specific incident updates, or send a single (standalone) question survey to determine how an issue was handled.

To allow users outside the Cortex XSOAR server network to access the communication task link, you need to configure access to the communication task through an engine.

Data Collection Tasks

The Data Collection task is a multi-question survey (form) that survey recipients access from a link in the message. The survey resides on an external site that does not require authentication, thereby allowing survey recipients to respond without restriction.

All responses are collected and recorded in the incident's context data, whether you receive responses from a single user or multiple users. This enables you to use the survey questions and answers as input for subsequent playbook tasks.

The following are examples of integrations that can use Data Collection tasks:

  • Email (EWS, Mail Sender, etc.)

  • Microsoft Teams

  • Slack


You can collect responses in custom fields, for example, a Grid field.

For all Data Collection tasks, a single link is generated for each recipient of the survey. By default, these links are hidden. To make the links visible, set the comm.datacollection.linktocontext.enabled server configuration set to true. These links can be viewed in the Incident's Context Data, by clicking on the ellipses menu and selecting Context Data. The links appear in the Context Data under the Links section of that survey.