DSPM Send Slack Notification to User

"Send Slack Notification to User" playbook is designed to notify a user via Slack and handle their response. It begins by sending a Slack notification to a specified email using the SlackBlockBuilder script. Afterward, it waits for the user's response until a predefined time, as configured in Prisma Cloud DSPM. Once the response is received, it is inserted into the incident's context. If there is an error in generating the Slack block, the incident is added for a re-run. Finally, the playbook extracts the user's response from the Slack block state for further processing.

DSPM · 24 tasks · 3 inputs · 0 outputs

Inputs

  • flowPath —
  • rerunTime — Incident re-run time (in hours)
  • slackMessageLifetime — Lifetime for slack notification (in seconds)

Commands used

addToList createList getList setList

Flowchart

no yes no no yes Invalid Response Slack #error# add Start Start Send slack notification to ${userSlackEmail} - SlackBlockBuilder Send slack notification t... SlackBlockBuilder Get SlackBlockBuilder response and insert it into an incident's context. - GetSlackBlockBuilderResponse Get SlackBlockBuilder re... GetSlackBlockBuilderResponse Are errors occurred when generating the Slack block list for the incident ID : ${incident_object.id} - DSPMCheckAndSetErrorEntries Are errors occurred when ... DSPMCheckAndSetErrorEntries ExtractUserResponseFromSlackBlockState - DSPMExtractUserResponseFromSlackBlockState ExtractUserResponseFromSl... DSPMExtractUserResponseFromSl... Create a Slackblock list to send a user notification displaying risk information. - DSPMCreateRiskSlackBlocks Create a Slackblock list ... DSPMCreateRiskSlackBlocks DSPMCheckAndSetErrorEntries - DSPMCheckAndSetErrorEntries DSPMCheckAndSetErrorEntries DSPMCheckAndSetErrorEntries sending notification to ${userSlackEmail} - SlackBlockBuilder sending notification to $... SlackBlockBuilder DSPM notify user in case of error - DSPM notify user in case of error DSPM notify user in case ... DSPM notify user in case of e... Done Done Check invalid response? Check invalid response? Add incident for re-run - DSPMIncidentList Add incident for re-run DSPMIncidentList Get DSPM Incident List - getList Get DSPM Incident List getList Check incident list status? Check incident list status? Add incident in DSPM Incident list - addToList Add incident in DSPM Inc... addToList Create DSPM Incident list - createList Create DSPM Incident list createList Create Slack block sending notification to user. - DSPMCreateSimpleSlackMessageBlock Create Slack block sendin... DSPMCreateSimpleSlackMessageB... Save the above slack block to the XSOAR list. - setList Save the above slack bloc... setList Save the above slack block to the XSOAR list. - setList Save the above slack bloc... setList Waiting for user replay till the set time in Prisma Cloud DSPM instance configuration. - Sleep Waiting for user replay t... Sleep Update user about invalid response Update user about invalid... Send slack notification to user Send slack notification t... Deleting slack block from context after saving into xsoar list. - DeleteContext Deleting slack block from... DeleteContext Deleting slack block after saving into xsoar list. - DeleteContext Deleting slack block afte... DeleteContext