Create an Ask Task - Playbook Design Guide - 6.x - Cortex XSOAR - Cortex - Security Operations

Cortex XSOAR Playbook Design Guide

Product
Cortex XSOAR
Version
6.x
Creation date
2023-01-19
Last date published
2023-12-19
Category
Playbook Design Guide

The conditional ask task is a single question survey, the answer to which determines how a playbook proceeds. If you send the survey to multiple users, the first answer received is used, and subsequent responses are disregarded.

When creating an ask task, there are several tabs where you can enter values. Some configurations are required, and some are optional. Click each tab for detailed information.

If the playbook was installed from a content pack, duplicate or detach the playbook, before creating an ask task.

If you want to view the link generated by the task in the Incident's Context Data, you must first make the links visible., By default, these links are hidden. To make the links visible, add the comm.ask.linktocontext.enabled server configuration set to true. The links appear under Ask.Links in the Context Data.Modify Server Configurations

  1. In a playbook, click + (Create task).

  2. Select the Conditional option.

  3. Enter a meaningful name for the task, which corresponds to the data that you are collecting. For example, Was the Incident escalated?

  4. Select the Ask option.

    ask-task.png
  5. (Optional) To customize the look and feel of your email message, click Preview.

    You can change the color scheme and how text in the message header and body appear.

    playbook-comm-task-display-customizatin.png