Create an Ask Task - Administrator Guide - 8 - Cortex XSOAR - Cortex - Security Operations

Cortex XSOAR Administrator Guide

Product
Cortex XSOAR
Version
8
Creation date
2024-09-18
Last date published
2024-11-28
Category
Administrator Guide
Solution
Cloud
Retire_Doc
Retiring
Link_to_new_Doc
/r/Cortex-XSOAR/8/Cortex-XSOAR-Cloud-Documentation
Abstract

Create a conditional Ask task in a playbook. An Ask task is a single question survey that determines how the playbook proceeds. Answer is recorded in context.

The conditional ask task is a single question survey, the answer to which determines how a playbook proceeds. If you send the survey to multiple users, the first answer received is used, and subsequent responses are disregarded.

When creating an ask task, there are several tabs where you can enter values. Some configurations are required, and some are optional. Click each tab for detailed information.

If the playbook was installed from a content pack, duplicate or detach the playbook, before creating an ask task.

  1. In a playbook, click + (Create task).

  2. Select the Conditional option.

  3. Enter a meaningful name for the task, which corresponds to the data that you are collecting. For example, Was the Incident escalated?

  4. Select the Ask option.

  5. Select the communication options you want to use to collect the data.

    • The Task option is selected by default. The data collection survey can be completed directly in the workplan.

    • If you select Generated link, a link to the data collection survey is available in the context data of the incident.

    • If you select Email, enter the subject and message of the email and the email addresses of the users who should receive this message or survey.

    • Some integrations can be used to collect data for Ask Tasks, such as Microsoft Teams and Slack. If any of these integrations are installed, it will appear as an option.

  6. (Optional) To customize the look and feel of your email message, click Preview.

    You can change the color scheme and how text in the message header and body appear.

    playbook-comm-task-display-customizatin.png