DSPM Send Slack Notification to User

"Send Slack Notification to User" playbook is designed to notify a user via Slack and handle their response. It begins by sending a Slack notification to a specified email using the SlackBlockBuilder script. Afterward, it waits for the user's response until a predefined time, as configured in Prisma Cloud DSPM. Once the response is received, it is inserted into the incident's context. If there is an error in generating the Slack block, the incident is added for a re-run. Finally, the playbook extracts the user's response from the Slack block state for further processing.
DSPM · 24 tasks · 3 inputs · 0 outputs
Details

ID	`DSPM Send Slack Notification to User`
From Version	6.10.0
Tasks	24
README

“Send Slack Notification to User” playbook is designed to notify a user via Slack and handle their response. It begins by sending a Slack notification to a specified email using the SlackBlockBuilder script. Afterwards, it waits for the user’s response until a predefined time, as configured in Prisma Cloud DSPM. Once the response is received, it is inserted into the incident’s context. If there is an error in generating the Slack block, the incident is added for a re-run. Finally, the playbook extracts the user’s response from the Slack block state for further processing.
Dependencies

This playbook uses the following sub-playbooks, integrations, and scripts.
Sub-playbooks

DSPM notify user in case of error
Integrations

This playbook does not use any integrations.
Scripts

DSPMIncidentList
DSPMCreateSimpleSlackMessageBlock
DeleteContext
DSPMExtractUserResponseFromSlackBlockState
SlackBlockBuilder
GetSlackBlockBuilderResponse
DSPMCheckAndSetErrorEntries
DSPMCreateRiskSlackBlocks
Sleep
Commands

addToList
createList
getList
setList
Playbook Inputs

Name	Description	Default Value	Required
flowPath		slack	Optional
rerunTime	Incident re-run time (in hours)		Optional
slackMessageLifetime	Lifetime for slack notification (in seconds)		Optional
Playbook Outputs

There are no outputs for this playbook.
Playbook Image

DSPM Send Slack Notification to User
Inputs

flowPath —
rerunTime — Incident re-run time (in hours)
slackMessageLifetime — Lifetime for slack notification (in seconds)
Commands used

addToList createList getList setList
Flowchart

Source

playbook-DSPM_Send_Slack_Notification_to_User.yml
Download History Raw
id: DSPM Send Slack Notification to User
version: -1
name: DSPM Send Slack Notification to User
description: '"Send Slack Notification to User" playbook is designed to notify a user via Slack and handle their response. It begins by sending a Slack notification to a specified email using the SlackBlockBuilder script. Afterward, it waits for the user''s response until a predefined time, as configured in Prisma Cloud DSPM. Once the response is received, it is inserted into the incident''s context. If there is an error in generating the Slack block, the incident is added for a re-run. Finally, the playbook extracts the user''s response from the Slack block state for further processing.'
starttaskid: "0"
tasks:
  "0":
    id: "0"
    taskid: b28b18a1-c34f-4860-8cdc-bc1acfc609b1
    type: start
    task:
      id: b28b18a1-c34f-4860-8cdc-bc1acfc609b1
      version: -1
      name: ""
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "16"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 480,
          "y": 50
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "1":
    id: "1"
    taskid: 1dbc2248-59af-4438-8c5d-c879f7417ff1
    type: regular
    task:
      id: 1dbc2248-59af-4438-8c5d-c879f7417ff1
      version: -1
      name: Send slack notification to ${userSlackEmail}
      description: SlackBlockBuilder will format a given Slack block into a format readable by the SlackV3 integration. The script will also send the block to the given destination. Make sure to mark **Trust any certificate** and fill the **XSOAR API Key integration** parameters if you want to get a response to the incident context.
      scriptName: SlackBlockBuilder
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "3"
    scriptarguments:
      list_name:
        simple: 'slack block of Incident ID : ${incident.id}'
      task:
        simple: "224"
      user:
        simple: ${userSlackEmail}
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 50,
          "y": 1915
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "3":
    id: "3"
    taskid: 539591aa-46fd-4790-84f3-a7f9afea2480
    type: regular
    task:
      id: 539591aa-46fd-4790-84f3-a7f9afea2480
      version: -1
      name: ' Get SlackBlockBuilder response and insert it into an incident''s context.'
      description: GetSlackBlockBuilderResponse will format a SlackBlockBuilder response and insert it into an incident's context.
      scriptName: GetSlackBlockBuilderResponse
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "4"
    separatecontext: false
    continueonerror: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 265,
          "y": 2090
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "4":
    id: "4"
    taskid: a6d0526e-0da1-4296-8879-2531e894d744
    type: condition
    task:
      id: a6d0526e-0da1-4296-8879-2531e894d744
      version: -1
      name: 'Are errors occurred when generating the Slack block list for the incident ID : ${incident_object.id}'
      description: This script checks for error entries based on provided entry IDs and returns "yes" if any errors are found or "no" if no errors are present. If errors are detected, it sets the error messages in the XSOAR context.
      scriptName: DSPMCheckAndSetErrorEntries
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      "no":
      - "7"
      "yes":
      - "19"
    scriptarguments:
      entry_id:
        simple: ${lastCompletedTaskEntries}
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 265,
          "y": 2265
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "7":
    id: "7"
    taskid: c6259536-fea6-454a-876d-8ff7842ffff1
    type: regular
    task:
      id: c6259536-fea6-454a-876d-8ff7842ffff1
      version: -1
      name: ExtractUserResponseFromSlackBlockState
      scriptName: DSPMExtractUserResponseFromSlackBlockState
      type: regular
      iscommand: false
      brand: ""
      description: "This script processes user responses from a Slack block interaction"
    nexttasks:
      '#none#':
      - "15"
    scriptarguments:
      SlackBlockState:
        simple: ${SlackBlockState}
      incident_data:
        simple: ${incident_object}
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 265,
          "y": 2965
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "9":
    id: "9"
    taskid: 64feb165-fa4b-4923-84e0-022b4882fbc8
    type: regular
    task:
      id: 64feb165-fa4b-4923-84e0-022b4882fbc8
      version: -1
      name: Create a Slackblock list to send a user notification displaying risk information.
      description: This XSOAR automation script generates a Slack message block to notify users of risks detected by a Data Security Posture Management (DSPM) tool. The Slack block is dynamically constructed based on the details of the security incident and includes options for users to take specific actions, such as creating a Jira ticket or remediating the risk.
      scriptName: DSPMCreateRiskSlackBlocks
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "25"
    scriptarguments:
      dspm_incident:
        simple: ${incident_object}
      dspmIncident:
        simple: ${incident_object}
      incidentLink:
        simple: ${demistoUrls.investigation}
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 357.5,
          "y": 1215
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "10":
    id: "10"
    taskid: a37d93da-381c-48b8-8db0-c258b7b637d6
    type: condition
    task:
      id: a37d93da-381c-48b8-8db0-c258b7b637d6
      version: -1
      name: DSPMCheckAndSetErrorEntries
      description: This script checks for error entries based on provided entry IDs and returns "yes" if any errors are found or "no" if no errors are present. If errors are detected, it sets the error messages in the XSOAR context.
      scriptName: DSPMCheckAndSetErrorEntries
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      "no":
      - "1"
      - "26"
      "yes":
      - "13"
    scriptarguments:
      entry_id:
        simple: ${lastCompletedTaskEntries}
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 357.5,
          "y": 1740
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "11":
    id: "11"
    taskid: fd7c9d0b-548b-4926-8d3c-c8f30a2d9a54
    type: regular
    task:
      id: fd7c9d0b-548b-4926-8d3c-c8f30a2d9a54
      version: -1
      name: sending notification to ${userSlackEmail}
      description: SlackBlockBuilder will format a given Slack block into a format readable by the SlackV3 integration. The script will also send the block to the given destination. Make sure to mark **Trust any certificate** and fill the **XSOAR API Key integration** parameters if you want to get a response to the incident context.
      scriptName: SlackBlockBuilder
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "9"
    scriptarguments:
      list_name:
        simple: 'slack block of Incident ID : ${incident.id}'
      user:
        simple: ${userSlackEmail}
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 357.5,
          "y": 1040
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "13":
    id: "13"
    taskid: 35dbf5f1-b398-4548-8881-7baf66a6ac46
    type: playbook
    task:
      id: 35dbf5f1-b398-4548-8881-7baf66a6ac46
      version: -1
      name: DSPM notify user in case of error
      description: The DSPM Notify User in Case of Error playbook is designed to handle errors in DSPM incidents by notifying users and managing Slack notifications.
      playbookName: DSPM notify user in case of error
      type: playbook
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "15"
    scriptarguments:
      rerunTime:
        simple: ${inputs.rerunTime}
    separatecontext: true
    continueonerrortype: ""
    loop:
      iscommand: false
      exitCondition: ""
      wait: 1
      max: 100
    view: |-
      {
        "position": {
          "x": 817.5,
          "y": 2965
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "15":
    id: "15"
    taskid: 0ddb7b08-b1da-40ea-820f-f9b2bcdf490d
    type: title
    task:
      id: 0ddb7b08-b1da-40ea-820f-f9b2bcdf490d
      version: -1
      name: Done
      type: title
      iscommand: false
      brand: ""
      description: ''
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 1032.5,
          "y": 3140
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "16":
    id: "16"
    taskid: e7347d3b-fc82-4f5c-8ee3-c034dd19242a
    type: condition
    task:
      id: e7347d3b-fc82-4f5c-8ee3-c034dd19242a
      version: -1
      name: Check invalid response?
      type: condition
      iscommand: false
      brand: ""
      description: ""
    nexttasks:
      Invalid Response:
      - "27"
      Slack:
      - "28"
    separatecontext: false
    conditions:
    - label: Invalid Response
      condition:
      - - operator: isEqualString
          left:
            value:
              simple: inputs.flowPath
            iscontext: true
          right:
            value:
              simple: invalid
    - label: Slack
      condition:
      - - operator: isEqualString
          left:
            value:
              simple: inputs.flowPath
            iscontext: true
          right:
            value:
              simple: slack
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 480,
          "y": 195
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "18":
    id: "18"
    taskid: 27e61977-cb0e-46bd-85d1-ef6df2a0665d
    type: regular
    task:
      id: 27e61977-cb0e-46bd-85d1-ef6df2a0665d
      version: -1
      name: Add incident for re-run
      scriptName: DSPMIncidentList
      type: regular
      iscommand: false
      brand: ""
      description: "Add incident for re-run."
    nexttasks:
      '#none#':
      - "20"
    scriptarguments:
      action:
        simple: add
      incident_data:
        simple: ${incident_object}
      incident_list:
        simple: ${lists.INCIDENT_LIST2}
      rerun_time:
        simple: ${inputs.rerunTime}
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 1247.5,
          "y": 2615
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "19":
    id: "19"
    taskid: 064b3688-f566-44fb-88d2-050caf2e2cd5
    type: regular
    task:
      id: 064b3688-f566-44fb-88d2-050caf2e2cd5
      version: -1
      name: Get DSPM Incident List
      description: commands.local.cmd.list.get
      script: Builtin|||getList
      type: regular
      iscommand: true
      brand: Builtin
    nexttasks:
      '#error#':
      - "22"
      '#none#':
      - "18"
    scriptarguments:
      listName:
        simple: INCIDENT_LIST2
    separatecontext: false
    continueonerror: true
    continueonerrortype: errorPath
    view: |-
      {
        "position": {
          "x": 1565,
          "y": 2440
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "20":
    id: "20"
    taskid: 3fa2fd7e-6c16-4bff-8224-8c09c2802565
    type: condition
    task:
      id: 3fa2fd7e-6c16-4bff-8224-8c09c2802565
      version: -1
      name: Check incident list status?
      type: condition
      iscommand: false
      brand: ""
      description: ""
    nexttasks:
      add:
      - "21"
    separatecontext: false
    conditions:
    - label: add
      condition:
      - - operator: containsGeneral
          left:
            value:
              simple: listStatus
            iscontext: true
          right:
            value:
              simple: Successfully added incident data
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 1247.5,
          "y": 2790
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "21":
    id: "21"
    taskid: ab814cd6-2d8c-4bcc-8929-beab5a2f6ef0
    type: regular
    task:
      id: ab814cd6-2d8c-4bcc-8929-beab5a2f6ef0
      version: -1
      name: Add incident in  DSPM Incident list
      description: commands.local.cmd.list.add
      script: Builtin|||addToList
      type: regular
      iscommand: true
      brand: Builtin
    nexttasks:
      '#none#':
      - "15"
    scriptarguments:
      listData:
        simple: '{"incident_id":"${incident.id}","incident_created":"${incident_object.incidentCreated}"}'
      listName:
        simple: INCIDENT_LIST2
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 1247.5,
          "y": 2965
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "22":
    id: "22"
    taskid: 65e97611-c6d9-4106-833b-4459ca899fb6
    type: regular
    task:
      id: 65e97611-c6d9-4106-833b-4459ca899fb6
      version: -1
      name: Create DSPM Incident list
      description: commands.local.cmd.list.create
      script: Builtin|||createList
      type: regular
      iscommand: true
      brand: Builtin
    nexttasks:
      '#none#':
      - "15"
    scriptarguments:
      listData:
        simple: '{"incident_id":"${incident.id}","incident_created":"${incident_object.incidentCreated}"}'
      listName:
        simple: INCIDENT_LIST2
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 1677.5,
          "y": 2965
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "23":
    id: "23"
    taskid: b3fac38b-c75f-4944-8d95-96114190d24d
    type: regular
    task:
      id: b3fac38b-c75f-4944-8d95-96114190d24d
      version: -1
      name: Create Slack block sending notification to user.
      description: This automation script overwrites the value of a specified list and sends a Slack notification to inform the user that they failed to respond to an incident notification in a timely manner. The notification includes a message indicating the end of the incident playbook and an invitation to reopen the incident if necessary.
      scriptName: DSPMCreateSimpleSlackMessageBlock
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "24"
    scriptarguments:
      incident_id:
        simple: ${incident_object.incidentId}
      incidentLink:
        simple: ${demistoUrls.investigation}
      list_name:
        simple: ${block_list_name}
      message:
        simple: "You have provided invalid response to ${incident_object.incidentId} \n Incident notification. Resending the notification for Incident ${incident_object.incidentId} respond with valid details.\nRegards."
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 357.5,
          "y": 515
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "24":
    id: "24"
    taskid: fec228dd-f087-4c36-8b91-bee6ff6695fd
    type: regular
    task:
      id: fec228dd-f087-4c36-8b91-bee6ff6695fd
      version: -1
      name: Save the above slack block to the XSOAR list.
      description: Set data in list
      script: Builtin|||setList
      type: regular
      iscommand: true
      brand: Builtin
    nexttasks:
      '#none#':
      - "29"
    scriptarguments:
      listData:
        simple: ${slackBlock}
      listName:
        simple: 'slack block of Incident ID : ${incident.id}'
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 357.5,
          "y": 690
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "25":
    id: "25"
    taskid: eb881ce6-a909-4fc9-8bef-85315f755f2c
    type: regular
    task:
      id: eb881ce6-a909-4fc9-8bef-85315f755f2c
      version: -1
      name: Save the above slack block to the XSOAR list.
      description: Set data in list
      script: Builtin|||setList
      type: regular
      iscommand: true
      brand: Builtin
    nexttasks:
      '#none#':
      - "30"
    scriptarguments:
      listData:
        simple: ${slackBlock.block}
      listName:
        simple: 'slack block of Incident ID : ${incident.id}'
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 357.5,
          "y": 1390
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "26":
    id: "26"
    taskid: 81b393a6-f760-4046-80e6-3943fd1233f9
    type: regular
    task:
      id: 81b393a6-f760-4046-80e6-3943fd1233f9
      version: -1
      name: Waiting for user replay till the set time in Prisma Cloud DSPM instance configuration.
      description: Sleep for X seconds.
      scriptName: Sleep
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "3"
    scriptarguments:
      seconds:
        simple: ${inputs.slackMessageLifetime}
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 480,
          "y": 1915
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "27":
    id: "27"
    taskid: 4021381c-96fe-416c-84cb-1edcd298beee
    type: title
    task:
      id: 4021381c-96fe-416c-84cb-1edcd298beee
      version: -1
      name: Update user about invalid response
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "23"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 357.5,
          "y": 370
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "28":
    id: "28"
    taskid: 5b0227ef-951b-4a51-8025-d21ea7fac9d3
    type: title
    task:
      id: 5b0227ef-951b-4a51-8025-d21ea7fac9d3
      version: -1
      name: Send slack notification to user
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "1"
      - "26"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 787.5,
          "y": 1755
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "29":
    id: "29"
    taskid: 98c1f2a1-d8e9-4ec5-8213-2799a0faf808
    type: regular
    task:
      id: 98c1f2a1-d8e9-4ec5-8213-2799a0faf808
      version: -1
      name: Deleting slack block from context after saving into xsoar list.
      description: |-
        Delete field from context.

        This automation runs using the default Limited User role, unless you explicitly change the permissions.
        For more information, see the section about permissions here:
        - For Cortex XSOAR 6 see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.x/Cortex-XSOAR-Playbook-Design-Guide/Automations 
        - For Cortex XSOAR 8 Cloud see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8/Cortex-XSOAR-Cloud-Documentation/Create-a-script
        - For Cortex XSOAR 8.7 On-prem see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8.7/Cortex-XSOAR-On-prem-Documentation/Create-a-script
      scriptName: DeleteContext
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "11"
    scriptarguments:
      key:
        simple: slackBlock
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 357.5,
          "y": 865
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "30":
    id: "30"
    taskid: b38e26ff-9ff8-44d8-804d-8bc4a169e278
    type: regular
    task:
      id: b38e26ff-9ff8-44d8-804d-8bc4a169e278
      version: -1
      name: Deleting slack block after saving into xsoar list.
      description: |-
        Delete field from context.

        This automation runs using the default Limited User role, unless you explicitly change the permissions.
        For more information, see the section about permissions here:
        - For Cortex XSOAR 6 see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.x/Cortex-XSOAR-Playbook-Design-Guide/Automations 
        - For Cortex XSOAR 8 Cloud see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8/Cortex-XSOAR-Cloud-Documentation/Create-a-script
        - For Cortex XSOAR 8.7 On-prem see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8.7/Cortex-XSOAR-On-prem-Documentation/Create-a-script
      scriptName: DeleteContext
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "10"
    scriptarguments:
      key:
        simple: slackBlock
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 357.5,
          "y": 1565
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
view: |-
  {
    "linkLabelsPosition": {},
    "paper": {
      "dimensions": {
        "height": 3155,
        "width": 2007.5,
        "x": 50,
        "y": 50
      }
    }
  }
inputs:
- key: flowPath
  value:
    simple: slack
  required: false
  description: ""
  playbookInputQuery:
- key: rerunTime
  value: {}
  required: false
  description: Incident re-run time (in hours)
  playbookInputQuery:
- key: slackMessageLifetime
  value: {}
  required: false
  description: Lifetime for slack notification (in seconds)
  playbookInputQuery:
inputSections:
- inputs:
  - flowPath
  - rerunTime
  - slackMessageLifetime
  name: General (Inputs group)
  description: Generic group for inputs
outputSections:
- outputs: []
  name: General (Outputs group)
  description: Generic group for outputs
outputs: []
quiet: true
tests:
- No tests (auto formatted)
fromversion: 6.10.0