SlackV3

Send messages and notifications to your Slack team.
This integration was integrated and tested with Slack.

Configure SlackV3 in Cortex

Slack V3 utilizes “Socket Mode” to enable the integration to
communicate directly with Slack for mirroring. This requires a dedicated Slack app to be created for the Cortex XSOAR
integration. See Creating a Custom App on how to create your App in Slack.

Refer to
the video tutorial
to learn about configuring SlackV3 using the app manifest.

Caching

When the Disable Caching of Users and Channels parameter is configured, there are no pagination calls made to Slack.
This is to avoid rate limiting which can occur in workspaces where there are excessive amounts of channels or users. If
there were no timeout issues with running commands on your environment prior to pack version 2.3.0, there is no direct
need to enable this mode.

Additionally. with the Common Channels parameter configured, channels and their IDs found in this parameter will be
accessible to the integration to use while caching is disabled.

Finding a Channel ID

Common Channels follows the format, First ChannelName:FirstChannelID, Second ChannelName:SecondChannelID. To find
the channel ID for the channels that are frequently used:

1. Navigate to the channel you want to retrieve an ID for.

2. Click the name of the channel.

   On the bottom of the presented menu, the channel ID can be found.

Channel IDs typically follow the format C + an alphanumeric string.

Creating a Custom App

1. Navigate to: https://api.slack.com/apps/ .
2. Click Create an App.

1. Click From an app manifest.

1. Pick the workspace you would like the app to reside in and click Next.

1. Copy the text in the file
   found here
   . The text is a manifest template with the recommended configuration for your app.
2. Paste the copied text into the field “YAML” and click Next.

1. The next step is a summary of the app we created. Click Create to proceed.

Installing the App to Your Workspace

1. After creating your app, you will be redirected to the Basic Information page of your app settings.

   Click Install to Workspace

This will bring up a page which confirms that you are installing the app to your workspace.

If you do not see this step, you must request access from your Slack admin in order to proceed.

1. Once the app has been installed you will be redirected to the General page for your app. Scroll down to the
   section called App-Level Tokens and click Generate Token and Scopes

1. Enter a name for the Token and click Add Scope. Select the connections:write scope from the list.

1. Click Generate.
2. You will be redirected to a page which will display your app token. This token begins with xapp. Copy this token.

1. In your Cortex XSOAR SlackV3 instance configuration page, paste the token in the App Token parameter. You may also
   configure the App Token as a credential.

1. Navigate back to the Slack App configuration page and select OAuth & Permissions. If this screen does not look
   like the following image, you may need assistance from your Slack admin.

1. Copy the Bot User OAuth Token.
2. In your Cortex XSOAR SlackV3 instance configuration page, paste the token in the parameter. You may also configure
   the Bot Token as a credential.

NOTE: When utilizing long-running features such as mirroring or SlackAsk, each integration instance must have a dedicated bot
and tokens that should not be used elsewhere. Failure to comply with this requirement may result in issues with incoming
messages and the steady flow of the integration.

Testing the Bot

1. Once you have configured the Dedicated Slack channel to receive notifications parameter, open Slack and invite your
   new app to the channel you have configured.
2. Navigate to your Instance Settings page in Cortex XSOAR and click Test. A message should appear in the channel
   from your app.

Cortex Agentic Assistant in Slack

The Slack integration allows users to interact with the Cortex Agentic Assistant directly from Slack. Users can mention the bot in any channel or thread to ask security questions, run investigations, and receive AI-powered responses, all without leaving Slack.

Prerequisites

Before you begin, ensure the following requirements are met:

1. Supported Cortex product version — The tenant must be running one of the following versions (or later), depending on your product:

   Product	Minimum Version
   Cortex AGENTIX	V1.3
   Cortex Platform	1.5
   Cortex CLOUD	2.1
   Cortex XDR	3.18 / 5.1
   Cortex XSIAM	2.10 / 3.5

2. Slack App installed — The Slack app must be created and installed in your workspace as described in Creating a Custom App and Installing the App to Your Workspace.
3. Slack content pack version 3.6.0 or later — This includes the SlackV3 integration.
4. User permissions — Each Slack user who interacts with the Cortex Agentic Assistant must have the appropriate permissions to use the Cortex Agentic Assistant in the Cortex platform. Users without the required permissions will receive an error message when attempting to interact with the bot. Contact your Cortex administrator to ensure the relevant roles and permissions are assigned.

How to Enable

To enable this feature, configure the following in the integration instance settings.

1. Check Enabled AI assistant.
2. Long running instance — The Long running instance checkbox must be enabled in the instance settings (required for listening to bot mentions in real time).

How It Works

Once the prerequisites are met, users can interact with the Cortex Agentic Assistant by mentioning the bot (for example, @YourBotName <your question>) in any Slack channel or thread where the bot has been added.

Note: Only users with the appropriate Cortex Agentic Assistant permissions can interact with the bot. Users without the required permissions will receive an error message prompting them to contact their administrator.

Conversation Flow

1. Mention the bot — Type @YourBotName followed by your question or request in a channel or thread.
2. Agent selection — On the first interaction, the assistant presents a dropdown menu of available AI agents (e.g., Case Investigation, Threat Intel). Select the agent best suited for your query.
3. AI response — The assistant replies in the same thread with the AI-generated response.
4. Follow-up questions — Continue the conversation in the same thread by mentioning the bot again. The assistant maintains context from previous messages in the thread (up to the last 5 messages).

Sensitive Action Approval

When the AI agent needs to perform a sensitive action (e.g., blocking an IP, isolating an endpoint), it will:

1. Display the action details with an ⚠️ Sensitive action detected warning.
2. Present Proceed and Cancel buttons.
3. Wait for the conversation owner to approve or reject the action before continuing.

Note: Only the user who started the conversation can approve or reject sensitive actions.

Available Commands

Feedback

Each AI response includes feedback buttons:

• Good response 👍 — Mark the response as helpful.
• Bad response 👎 — Opens a feedback modal where you can select specific issues (e.g., Factually incorrect, Unhelpful, Answered another question) and provide additional comments.

Feedback is sent back to the platform to help improve AI responses over time.

Thread Locking

• Each thread is locked to the user who started the conversation. Other users cannot interact with the assistant in the same thread.
• Other users will see a message indicating the thread is locked and can start their own conversation in a different thread.
• To release a locked thread, any Cortex user can type @BotName !reset.

Session Management

Conversations automatically expire after 14 days of inactivity. After this period, the thread is unlocked, and a new conversation can begin.

Backward Compatibility with Slack V2

Slack V3 contains improvements to enhance the stability of the integration as well as the circumvention of OProxy. This
version is intended to provide customers with more granular control over the Slack integration by enabling the
Bring-Your-Own-App model and customizable scope-based authentication.

All commands are fully compatible with Slack V2 playbooks as their inputs and outputs have remained the same. As a
customer, you should notice no significant change in the behavior of the Slack integration with your existing playbooks.

Commands

You can execute these commands from the Cortex XSOAR CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

mirror-investigation

Mirrors the investigation between Slack and the Cortex XSOAR War Room.

Base Command

mirror-investigation

Input

Context Output

There is no context output for this command.

Command Example

!mirror-investigation direction="FromDemisto" channelName="example" using-brand="SlackV3"

Human Readable Output

Investigation mirrored successfully, channel:example

send-notification

Sends a message to a user, group, or channel.

Base Command

send-notification

Input

Context Output

Command Example

!send-notification channel="example" using-brand="SlackV3"

Context Example

{
    "Slack": {
        "Thread": {
            "ID": "1624272821.000700"
        }
    }
}

Human Readable Output

Message sent to Slack successfully.
Thread ID is: 1624272821.000700

close-channel

Archives a Slack channel.

Base Command

close-channel

Input

Context Output

There is no context output for this command.

Command Example

!close-channel channel=new-slack-channel

Human Readable Output

Channel successfully archived.

slack-send-file

Sends a file to a user, channel, or group. If not specified, the file is sent to the mirrored investigation channel (if
the channel exists).

Base Command

slack-send-file

Permissions

Permission scopes required for this command:

The full list of Slack API scopes can be accessed here.

Limitations

There are no known limitations for this command.

Input

Context Output

There is no context output for this command.

Command Example

!slack-send-file file=87@129 channel=testing-docs comment="Look at this gif!"

Human Readable Output

File sent to Slack successfully.

slack-set-channel-topic

Sets the topic for a channel.

Base Command

slack-set-channel-topic

Input

Context Output

There is no context output for this command.

Command Example

!slack-set-channel-topic topic="Testing topic for documentation" channel=testing-docs

Human Readable Output

Topic successfully set.

slack-create-channel

Creates a channel in Slack.

Base Command

slack-create-channel

Input

Context Output

Context Example

{
    "Slack": {
        "Channel": {
            "ID": "C0R2D2C3PO",
            "Name": "random"
        }
    }
}

Command Example

!slack-create-channel type="private" name="testing-docs"

Human Readable Output

Successfully created the channel testing-docs

slack-invite-to-channel

Invites users to join a channel.

Base Command

slack-invite-to-channel

Input

Context Output

There is no context output for this command.

Command Example

!slack-invite-to-channel users="Sir Testing McTesterface" channel=new-slack-channel

Human Readable Output

Successfully invited users to the channel.

slack-kick-from-channel

Removes users from the specified channel.

Base Command

slack-kick-from-channel

Input

Context Output

There is no context output for this command.

Command Example

!slack-kick-from-channel users="Sir Testing McTesterface" channel=new-slack-channel

Human Readable Output

Successfully kicked users from the channel.

slack-rename-channel

Renames a channel in Slack.

Base Command

slack-rename-channel

Input

Context Output

There is no context output for this command.

Command Example

!slack-rename-channel name="new-slack-channel" channel="testing-docs"

Human Readable Output

Channel renamed successfully.

slack-get-user-details

Get details about a specified user.

Base Command

slack-get-user-details

Input

Context Output

Command Example

!slack-get-user-details user="cortex_xsoar" using-brand="SlackV3"

Context Example

{
    "Slack": {
        "User": {
            "ID": "U0XXXXXXXX",
            "Name": "cortex_xsoar",
            "Username": "demisto_integration",
            "StatusText": "In a meeting"
        }
    }
}

Human Readable Output

Details for Slack user: cortex_xsoar

ID	Username	Name	Status Text
U0XXXXXXXX	demisto_integration	cortex_xsoar	In a meeting

slack-edit-message

Edit an existing Slack message.

Base Command

slack-edit-message

Input

Context Output

Command Example

!slack-edit-message channel="random" threadID="1629281551.001000" message="Eyy"

Context Example

{
    "Slack": {
        "Thread": {
            "ID": "1629281551.001000",
            "Channel": "C0XXXXXXXX",
            "Text": "Eyy"
        }
    }
}

Human Readable Output

The message was successfully edited.

slack-pin-message

Pins a selected message to the given channel.

Base Command

slack-pin-message

Input

Context Output

There is no context output for this command.

Command Example

!slack-pin-message channel=random threadID=1629281551.001000

Human Readable Output

The message was successfully pinned.

slack-get-integration-context

Returns the integration context as a file. Use this command for debug purposes only.

Base Command

slack-get-integration-context

Input

There are no input arguments for this command.

Context Output

There is no context output for this command.

slack-user-session-reset

Reset user session token in Slack.

Base Command

slack-user-session-reset

Input

Context Output

There is no context output for this command.

slack-list-channels

List all of the channels in the organization workspace. This command required scopes depend on the type of channel-like
object you’re working with. To use the command, you’ll need at least one of the channels:, groups:, im: or mpim: scopes
corresponding to the conversation type you’re working with.

Base Command

slack-list-channels

Input

Context Output

slack-get-conversation-history

Fetches a conversation’s history of messages and events

Base Command

slack-get-conversation-history

Input

Context Output

Command Example

!slack-get-conversation-history conversation_name="general" limit="2"

Context Example

{
    "Slack": {
        "Messages": [
            {
                "Type": "message",
                "Text": "Hello team, please review the latest security report.",
                "UserId": "U0XXXXXXXX",
                "Name": "exampleUser1",
                "FullName": "exampleUser2",
                "TimeStamp": "1727448123.000100",
                "HasReplies": "false",
                "ThreadTimeStamp": "1727448123.000100"
            },
            {
                "Type": "message",
                "Text": "Incident #1234 has been resolved.",
                "UserId": "U0YYYYYYYY",
                "Name": "exampleUser2",
                "FullName": "exampleUser2",
                "TimeStamp": "1727448000.000200",
                "HasReplies": "true",
                "ThreadTimeStamp": "1727448000.000200"
            }
        ]
    },
    "SlackConversationHistory": {
        "NextPageToken": "exampleToken"
    }
}

Human Readable Output

Conversation History for general

Type	Text	UserId	Name	FullName	TimeStamp	HasReplies	ThreadTimeStamp
message	Hello team, please review the latest security report.	U0XXXXXXXX	exampleUser1	exampleUser1	1727448123.000100	false	1727448123.000100
message	Incident #1234 has been resolved.	U0YYYYYYYY	exampleUser2	exampleUser2	1727448000.000200	true	1727448000.000200

slack-get-conversation-replies

Retrieves replies to specific messages, regardless of whether it’s from a public or private channel, direct message, or
otherwise.

Base Command

slack-get-conversation-replies

Input

Context Output

There is no context output for this command.

Known Limitations

• All commands which use channel as a parameter, it is now advised to use channel-id using the channel ID found in
  the incident’s context under the Slack.Channels.ID value. Using channel-id as opposed to channel will improve
  the performance of the integration.
• SlackV3 mirrors incidents by listening to messages being sent in channels the bot has been added to.
  Because of this, you may have some users in Slack who are not users in Cortex XSOAR. This will occasionally cause the
  module
  health to indicate that an error has occurred because a user was unable to be found. In this circumstance, the error
  is expected and is purely cosmetic in nature.
• In some cases when mirroring an investigation, kicking the admin will cause no further actions to be able to be
  performed by the bot. Any subsequent actions taken on the channel (such as mirror out) will result in a “not in
  channel” error.
• Note: If a dedicated channel is configured, however there are no notifications being sent, verify that the Types of
  Notifications to send parameter is populated.
• mirror-investigation will only mirror chat messages between Cortex XSOAR and Slack. Images, threads, and files
  are not supported at this tme.

Troubleshooting

Issue: The survey sent from SlackBlockBuilder is sent to Slack and submitted successfully, but the response does not
show up in context data in Cortex XSOAR.

Resolution: The most likely cause is that there is no API key entered into the Slack v3 integration instance
settings, or the API key was not created by the default admin user. Ensure that an API key created by a default admin
user is entered into the Slack v3 integration instance settings. Also, make sure to mark the Trust any certificate (
not secure) integration parameter.