sectionorder: - Connect - Collect - Agentic Assistant category: Messaging and Conferencing provider: Slack commonfields: id: SlackV3 version: -1 configuration: - display: '' displaypassword: Bot Token name: bot_token type: 9 hiddenusername: true section: Connect required: false - display: '' displaypassword: User Token name: user_token type: 9 hiddenusername: true section: Connect required: false - display: '' name: app_token type: 9 section: Connect required: false displaypassword: App Token hiddenusername: true - display: Dedicated Slack channel to receive notifications name: incidentNotificationChannel type: 0 section: Connect advanced: true required: false - display: Minimum incident severity by which to send messages to Slack name: min_severity type: 15 options: - Unknown - Low - Medium - High - Critical section: Collect advanced: true required: false defaultvalue: Low - display: Types of Notifications to Send. name: permitted_notifications type: 16 section: Collect hidden: - marketplacev2 - platform required: false options: - incidentAssigned - assign - incidentOpened - incidentChanged - investigationClosed - investigationDeleted - incidentReminderSLA - taskCompleted - incidentStatusChanged - failedFetchIncidents - mentionNew - mentionOld - deprecatedContentInUse advanced: true additionalinfo: Types of notifications to send (to individual users and to the dedicated Slack channel, if specified).To enable use User (User Name) -> User Preferences -> Notifications - display: Type of incidents created in Slack name: incidentType type: 13 section: Connect required: false defaultvalue: Unclassified - display: Allow external users to create incidents via DM name: allow_incidents type: 8 section: Collect advanced: true required: false - display: Ignore event retries name: ignore_event_retries type: 8 section: Collect advanced: true required: false additionalinfo: In some cases, events may not be processed fast enough. If you want to attempt to retry the event, select `false`. Note that this can result in some responses being double-posted. defaultvalue: 'true' - display: Use system proxy settings name: proxy type: 8 section: Connect advanced: true required: false - display: Trust any certificate (not secure) name: unsecure type: 8 section: Connect required: false advanced: true additionalinfo: Trust any certificate (not secure). Make sure to mark this parameter if you want the SlackBlockBuilder script to send a response back to the incident context. - defaultvalue: 'true' defaultvalue:xpanse: 'false' display: Enable Incident Mirroring name: mirroring type: 8 section: Connect required: false - display: Enable Outbound File Mirroring name: enable_outbound_file_mirroring type: 8 section: Connect required: false additionalinfo: Whether to enable mirroring only from xsoar to slack, mark it if file mirroring is required in investigations. - defaultvalue: 'true' defaultvalue:xpanse: 'false' display: Long running instance. Required for investigation mirroring and direct messages. name: longRunning type: 8 section: Connect advanced: true required: false additionalinfo: If your organization does not require incident mirroring, or data collection, it is possible to disable the `longRunning` parameter. For those organizations who do want to use these features, the parameter should be set to `True` to enable the long-running container. - defaultvalue: 'Cortex Assistant' display: Bot display name in Slack name: bot_name type: 0 section: Connect advanced: true required: false - defaultvalue: 'https://avatars.slack-edge.com/2020-05-24/1142885630851_5529c7f034d9b96ec39c_512.png' display: Bot icon in Slack - Image URL (Cortex XSOAR icon by default) name: bot_icon type: 0 section: Connect advanced: true required: false - display: Maximum time to wait for a rate limiting call in seconds name: max_limit_time type: 0 defaultvalue: '60' section: Connect advanced: true required: false - defaultvalue: 'true' display: Enabled AI assistant name: enabled_ai_assistant type: 8 section: Agentic Assistant required: false additionalinfo: Enable Cortex Assistant AI integration in Slack. When enabled, users can mention the bot to interact with AI agents for security analysis, threat intelligence, and automated responses. - display: Number of objects to return in each paginated call name: paginated_count type: 0 section: Collect advanced: true required: false defaultvalue: '200' - display: 'Comma-separated list of tags to filter the messages sent from Cortex XSOAR.' name: filtered_tags type: 0 additionalinfo: Only supported in Cortex XSOAR V6.1 and above. section: Collect advanced: true required: false - display: '' name: demisto_api_key type: 9 section: Connect advanced: true required: false displaypassword: XSOAR API Key hiddenusername: true additionalinfo: Adding an API key will enable the integration to handle blocks that contain a state and is necessary for the SlackBlockBuilder script. hidden: - marketplacev2 - xsoar - platform - display: Enable DMs to the bot name: enable_dm type: 8 defaultvalue: 'false' section: Collect advanced: true required: false - display: Disable Caching of Users and Channels name: disable_caching additionalinfo: This parameter prevents this integration from storing Users and Channels in the integration context. This parameter also prevents paginated calls which can result in timeout errors for large workspaces. type: 8 defaultvalue: 'false' section: Collect advanced: true required: false - display: Extensive Logging name: extensive_logging type: 8 additionalinfo: This parameter will write additional data to the logs and should only be used when you are directed to by XSOAR support. section: Connect advanced: true required: false defaultvalue: 'false' - display: Common Channels name: common_channels type: 12 additionalinfo: For workspaces where a handful of channels are consistently being used, you may add them as a CSV in the format ChannelName:ChannelID. section: Collect advanced: true required: false description: Send messages and notifications to your Slack team. display: Slack v3 name: SlackV3 script: commands: - arguments: - auto: PREDEFINED default: true defaultValue: all description: The mirroring type. Can be "all", which mirrors everything, "chat", which mirrors only chats (not commands), or "none", which stops all mirroring. name: type predefined: - all - chat - none - auto: PREDEFINED defaultValue: 'true' description: Whether the channel is auto-closed when an investigation is closed. Can be "true" or "false". Default is "true". name: autoclose predefined: - 'true' - 'false' - auto: PREDEFINED defaultValue: Both description: The mirroring direction. name: direction predefined: - Both - FromDemisto - ToDemisto - auto: PREDEFINED defaultValue: group description: The channel type. name: mirrorTo predefined: - channel - group - description: The name of the channel. The default is "incident-". name: channelName - description: The topic of the channel. name: channelTopic - auto: PREDEFINED defaultValue: 'false' description: Whether to remove the Slack administrator (channel creator) from the mirrored channel. name: kickAdmin predefined: - 'true' - 'false' - auto: PREDEFINED defaultValue: 'true' description: Whether the mirrored channel should be private or not (true by default). name: private predefined: - 'true' - 'false' description: Mirrors the investigation between Slack and the Cortex XSOAR War Room. name: mirror-investigation - arguments: - default: true description: 'The message content. When mentioning another Slack user, make sure to do so in the following format: <@user_name>.' name: message - description: The user to whom to send the message. Can be either the username or email address. name: to - description: The name of the Slack channel to which to send the message. name: channel - description: The ID of the Slack channel to which to send the message. name: channel_id - description: An entry ID to send as a link. name: entry - auto: PREDEFINED defaultValue: 'false' description: Whether to include a URL to the relevant component in Cortex XSOAR. name: ignoreAddURL predefined: - 'true' - 'false' - description: The ID of the thread to which to reply. Can be retrieved from a previous send-notification command. name: threadID - description: A JSON string of Slack blocks to send in the message. name: blocks description: Sends a message to a user, group, or channel. name: send-notification outputs: - contextPath: Slack.Thread.ID description: The Slack thread ID. type: String - arguments: - description: The name of the channel to archive. If not provided, the mirrored investigation channel is archived (if the channel exists). name: channel - description: The ID of the channel to archive. If not provided, the mirrored investigation channel is archived (if the channel exists). name: channel_id description: Archives a Slack channel. name: close-channel - arguments: - default: true description: The ID of the file entry to send. name: file required: true - description: The user to whom to send the file. Can be the username or the email address. name: to - description: The name of the Slack group (private channel) to which to send the file. name: group - description: The name of the Slack channel to which to send the file. name: channel - description: The ID of the Slack channel to which to send the file. name: channel_id - description: The ID of the thread to which to reply. Can be retrieved from a previous send-notification command. name: threadID - description: A comment to add to the file. name: comment description: 'Sends a file to a user, channel, or group. If not specified, the file is sent to the mirrored investigation channel (if the channel exists).' name: slack-send-file - arguments: - description: The channel name. If not specified, the topic of the mirrored investigation channel is set (if the channel exists). name: channel - description: The channel ID. If not specified, the topic of the mirrored investigation channel is set (if the channel exists). name: channel_id - default: true description: The topic for the channel. name: topic required: true description: Sets the topic for a channel. name: slack-set-channel-topic - arguments: - auto: PREDEFINED defaultValue: private description: The channel type. name: type predefined: - private - public - default: true description: The name of the channel. name: name required: true - description: 'A CSV list of user names or email addresses to invite to the channel. For example: "user1, user2...".' name: users description: Creates a channel in Slack. outputs: - contextPath: Slack.Channel.ID description: The ID of the channel. type: String - contextPath: Slack.Channel.Name description: The name of the channel. type: String name: slack-create-channel - arguments: - default: true description: 'A CSV list of usernames or email addresses to invite to join the channel. For example: "user1, user2...".' name: users required: true - description: The name of the channel to which to invite the users. If the name of the channel is not specified, the name of the mirrored investigation channel is used (if the channel exists). name: channel - description: The ID of the channel to which to invite the users. If the ID of the channel is not specified, the ID of the mirrored investigation channel is used (if the channel exists). name: channel_id description: Invites users to join a channel. name: slack-invite-to-channel - arguments: - default: true description: 'A CSV list of usernames or email addresses to remove from the a channel. For example: "user1, user2...".' name: users required: true - description: The name of the channel from which to remove the users. If the name of the channel is not specified, the mirrored investigation channel is used (if the channel exists). name: channel - description: The ID of the channel from which to remove the users. If the ID of the channel is not specified, the mirrored investigation channel is used (if the channel exists). name: channel_id description: Removes users from the specified channel. name: slack-kick-from-channel - arguments: - default: true description: The new name of the channel. name: name required: true - description: The current name of the channel. If the name of the channel is not specified, the mirrored investigation channel is used (if the channel exists). name: channel - description: The current ID of the channel. If the ID of the channel is not specified, the mirrored investigation channel is used (if the channel exists). name: channel_id description: Renames a channel in Slack. name: slack-rename-channel - arguments: - default: true description: The Slack user (username, email or user ID). name: user required: true compliantpolicies: - User Hard Remediation - User Soft Remediation description: Get details about a specified user. name: slack-get-user-details outputs: - contextPath: Slack.User.ID description: The ID of the user. type: String - contextPath: Slack.User.Username description: The username of the user. type: String - contextPath: Slack.User.Name description: The actual name of the user. type: String - contextPath: Slack.User.DisplayName description: The display name of the user. type: String - contextPath: Slack.User.Email description: The email address of the user. type: String - contextPath: Slack.User.StatusText description: The status text of the user. type: String - description: Returns the integration context as a file. Use this command for debug purposes only. hidden: true name: slack-get-integration-context - arguments: - description: The channel containing the message. name: channel - description: The ID of the thread of which to pin. Can be retrieved from a previous send-notification command. name: threadID required: true - description: The ID for the channel containing the message. name: channel_id description: Pins a selected message to the given channel. name: slack-pin-message - arguments: - description: The channel the message is posted in. name: channel - description: The ID for the channel the message is posted in. name: channel_id - description: The ID of the thread of which to edit. Can be retrieved from a previous send-notification command. name: threadID required: true - description: The updated message. name: message - description: A JSON string of the block to send. name: blocks - name: ignore_add_url description: Whether to include a URL to the relevant component in XSOAR. Can be "true" or "false". Default value is "false". description: Edit an existing Slack message. name: slack-edit-message outputs: - contextPath: Slack.Thread.ID description: The timestamp identifier for the message. type: String - contextPath: Slack.Thread.Channel description: The channel ID the message was posted in. type: String - contextPath: Slack.Thread.Text description: The text the message was updated with. type: String - arguments: - description: The user id of the user. name: user_id required: true description: Reset user session token in Slack. name: slack-user-session-reset compliantpolicies: - User Soft Remediation - arguments: - description: 'Supply this argument to only return channels with this name.' name: name_filter - defaultValue: public_channel description: 'You can provide a comma separated list of other channels to include in your results. Possible options are: "public_channel", "private_channel", "mpim", and "im". Including these options may require changes to your Bot''s OAuth scopes in order to read channels like private, group message, or personal messages.' name: channel_types - defaultValue: 'true' description: Default is true (exclude archived channels). This setting allows the command to read channels that have been archived. name: exclude_archived - defaultValue: 100 description: Set this argument to specify how many results to return. If you have more results than the limit you set, you will need to use the cursor argument to paginate your results. name: limit - description: 'Default is the first page of results. If you have more results than your limit, you need to paginate your results with this argument. This is found with the next_cursor attribute returned by a previous request''s response_metadata.' name: cursor description: 'List all of the channels in the organization workspace. This command required scopes depend on the type of channel-like object you''re working with. To use the command, you''ll need at least one of the channels:, groups:, im: or mpim: scopes corresponding to the conversation type you''re working with.' name: slack-list-channels outputs: - contextPath: Slack.Channels.ID description: The ID for the channel. type: string - contextPath: Slack.Channels.Name description: Name of the channel. type: string - contextPath: Slack.Channels.Created description: Epoch timestamp when the channel was created. type: number - contextPath: Slack.Channels.Creator description: ID for the creator of the channel. type: string - contextPath: Slack.Channels.Purpose description: The purpose, or description, of the channel. type: string - arguments: - description: Deprecated. Use *conversation_id* instead. name: channel_id deprecated: true - description: The name of the conversation. For channels, provide the channel name. For direct messages, use the username or display name. Either this or *conversation_id* is required. If both are provided, *conversation_id* takes precedence. name: conversation_name - description: The ID of the conversation. Either this or *conversation_name* is required. If both are provided, *conversation_id* takes precedence. name: conversation_id - defaultValue: 100 description: Set this argument to specify how many results to return. name: limit - description: | Lower bound for conversation history (sent to Slack 'oldest' query parameter). Returns messages with time stamp ≥ this value. Accepts Unix timestamp or ISO strings (e.g., "1727448000.000200", "2025-10-12T09:00:00+03:00"). Results are returned in descending order. name: from_time - description: Token to retrieve the next page of results. name: page_token - description: The timestamp of the thread for which to retrieve replies. When provided, the command behaves like the `slack-get-conversation-replies` command. name: thread_id hidden: true description: Fetches a conversation's history of messages and events. name: slack-get-conversation-history outputs: - contextPath: Slack.Messages.Type description: The type of the message (e.g., message, file_share, etc.). type: string - contextPath: Slack.Messages.Text description: The text content of the message. type: string - contextPath: Slack.Messages.UserId description: The user ID of the message sender. type: string - contextPath: Slack.Messages.Name description: The username of the message sender. type: string - contextPath: Slack.Messages.FullName description: The full name of the message sender. type: string - contextPath: Slack.Messages.TimeStamp description: The timestamp of the message. type: string - contextPath: Slack.Messages.HasReplies description: Whether the message has replies. type: string - contextPath: Slack.Messages.ThreadTimeStamp description: The thread timestamp of the message. type: string - contextPath: SlackConversationHistory.NextPageToken description: Token to retrieve the next page of results. type: string - arguments: - name: channel_id description: ID of the channel. required: true - name: thread_timestamp description: The timestamp of the thread, that can be extracted using "slack-get-conversation-history" command. required: true - defaultValue: 100 name: limit description: Set this argument to specify how many results to return. description: Retrieves replies to specific messages, regardless of whether it's from a public or private channel, direct message, or otherwise. name: slack-get-conversation-replies - arguments: - default: true description: 'The message to send to the channel. Use issue fields as variables to enrich the text. Example: “${issue.details}”.' name: message prettyname: Message required: true - description: The name of the Slack channel to which to send the message. name: channel prettyname: Channel required: true description: Sends a message to a user, group, or channel. name: slack-send-notification-quick-action prettyname: Send Slack Message hidden: true quickaction: true outputs: - contextPath: Slack.Thread.ID description: The Slack thread ID. type: String dockerimage: demisto/slackv3:1.0.0.10133006 longRunning: true runonce: false script: '-' subtype: python3 type: python isFetchSamples: true supportsquickactions: true fromversion: 5.5.0 tests: - SlackV3 TestPB - Test_SlackV3_NonCaching