DlpAskFeedback

Sends a message via Slack or MS Teams to the user whose activity violated DLP policies and triggered the incident.

python · Enterprise DLP by Palo Alto Networks

Details

ID	`DlpAskFeedback`
Language	python
From Version	5.5.0
Docker Image	`demisto/python3:3.12.13.10116658`

README

Sends a message via Slack to the user whose file upload violated DLP policies and triggered the incident.

Script Data

Name	Description
Script Type	python3
Cortex XSOAR Version	5.5.0

Dependencies

This script uses the following commands and scripts.

send-notification

Used In

This script is used in the following playbooks and scripts.

DLP Incident Feedback Loop

Inputs

Argument Name	Description
messenger	The messenger to use for sending notification,
file_name	The name of the file that triggered the incident.
data_profile_name	The name of the DLP data profile that detected the violation.
app_name	The application that performed the upload.
task	A manual task that this task can close.
user_display_name	The user name displayed in the Slack message.
user_id	The user ID to identify the recipient in Slack.
snippets	The snippets of the violation.
include_violation_detail	Whether to include violation details in the message.
question_type	Whether to ask the user about the file content or about exemption.

Outputs

There are no outputs for this script.

Source

DlpAskFeedback.py DlpAskFeedback_test.py DlpAskFeedback.yml

Download History Raw

commonfields:
  id: DlpAskFeedback
  version: -1
name: DlpAskFeedback
script: ''
type: python
tags: []
enabled: true
comment: Sends a message via Slack or MS Teams to the user whose activity violated DLP policies and triggered the incident.
args:
- name: messenger
  description: The messenger to use for sending notification,.
  auto: PREDEFINED
  predefined:
  - Slack
  - Microsoft Teams
  defaultValue: Slack
- name: file_name
  required: true
  description: The name of the file that triggered the incident.
- name: data_profile_name
  required: true
  description: The name of the DLP data profile that detected the violation.
- name: app_name
  description: The application that performed the activity.
- name: task
  description: A manual task that this task can close.
- name: user_display_name
  required: true
  description: The user name displayed in the Slack message.
- name: user_id
  description: The user ID to identify the recipient in Slack.

  required: true
- name: snippets
  description: The snippets of the violation.
- name: include_violation_detail
  required: true
  auto: PREDEFINED
  predefined:
  - 'True'
  - 'False'
  description: Whether to include violation details in the message.
  defaultValue: 'True'
- name: question_type
  required: true
  auto: PREDEFINED
  predefined:
  - ABOUT_FILE
  - ABOUT_EXEMPTION
  description: Whether to ask the user about the file content or about exemption.
  defaultValue: ABOUT_FILE
scripttarget: 0
subtype: python3
dependson:
  must:
  - SlackV3|||send-notification
  should:
  - SlackV3|||send-notification
runonce: false
dockerimage: demisto/python3:3.12.13.10116658
runas: DBotWeakRole
fromversion: 5.5.0
tests:
- No tests (auto formatted)