Skip to main content

Slack v3 (beta)

This Integration is part of the Slack Pack.#

Supported versions

Supported Cortex XSOAR versions: 5.5.0 and later.

beta

This is a beta Integration, which lets you implement and test pre-release software. Since the integration is beta, it might contain bugs. Updates to the integration during the beta phase might include non-backward compatible features. We appreciate your feedback on the quality and usability of the integration to help us identify issues, fix them, and continually improve.

Send messages and notifications to your Slack team. This integration was integrated and tested with Slack.

Configure SlackV3 on Cortex XSOAR#

Slack V3 utilizes "Socket Mode" to enable the integration to communicate directly with Slack for mirroring. This requires a dedicated Slack app to be created for the XSOAR integration. See Creating a Custom App on how to create your App in Slack.

  1. Navigate to Settings > Integrations > Servers & Services.

  2. Search for SlackV3.

  3. Click Add instance to create and configure a new integration instance.

    ParameterDescriptionRequired
    bot_tokenSlack API bot token.False
    app_tokenSlack API app token.False
    incidentNotificationChannelDedicated Slack channel to receive notifications.False
    min_severityMinimum incident severity to send messages to Slack by.False
    incidentTypeType of incidents created in Slack.False
    allow_incidentsAllow external users to create incidents via direct messages.False
    proxyUse system proxy settings.False
    unsecureTrust any certificate (not secure).False
    longRunningLong running instance. Required for investigation mirroring and direct messages.False
    bot_nameBot display name in Slack (Cortex XSOAR by default).False
    bot_iconBot icon in Slack - Image URL (Cortex XSOAR icon by default).False
    max_limit_timeMaximum time to wait for a rate limiting call in seconds.False
    paginated_countNumber of objects to return in each paginated call.False
    proxy_urlProxy URL to use in Slack API calls.False
    filtered_tagsComma-separated list of tags by which to filter the messages sent from XSOAR. Only supported in Cortex XSOAR V6.1 and above.False
    permitted_notificationsTypes of Notifications to send in the dedicated channel.False
  4. Click Test to validate the URLs, token, and connection.

Creating a Custom App#

  1. Navigate to: https://api.slack.com/apps/ .
  2. Click Create an App.

create-app-1

  1. Click From an app manifest.

create-app-2

  1. Next pick the workspace you would like the app to reside in and click Next.

create-app-3

  1. Next copy the text in the file found here. The text is a manifset template with the recommended configuration for your app.
  2. Paste the copied text into the field "YAML" and click Next.

create-app-4

  1. The next step is a summary of the app we created. Click Create to proceed.

create-app-5

Installing the App to Your Workspace#

  1. After creating your app, you will be redirected to the Basic Information page of your app settings. First, click Install to Workspace

    install-app-1

  2. This will bring up a page which confirms that you are installing the app to your workspace. If you do not see this step, you must request access from your Slack admin in order to proceed.

install-app-2

  1. Once the app has been installed you will be redirected to the General page for your app. Scroll down to the section called App-Level Tokens and click Generate Token and Scopes

install-app-3

  1. Enter a name for the Token and click Add Scope. Select the connections:write scope from the list.

install-app-4

  1. Click Generate.
  2. After click Generate you will be redirected to a page which will display your app token. This token begins with xapp. Copy this token.

install-app-5

  1. In your XSOAR SlackV3 intance configuration page. Paste the token in the parameter App Token. You may also configure the App Token as a credential.

install-app-6

  1. Navigate back to the Slack App configuration page and select OAuth & Permissions. If this screen does not look like the following image, you may need assistance from your Slack admin.

install-app-7

  1. Copy the Bot User OAuth Token.
  2. In your XSOAR SlackV3 intance configuration page. Paste the token in the parameter Bot Token. You may also configure the Bot Token as a credential.

install-app-8

Testing the Bot#

  1. Once you have configured the Dedicated Slack channel to receive notifications parameter, open Slack and invite your new app to the channel you have configured.
  2. Navigate to your Instance Settings page in XSOAR and click Test. A message should appear in the channel from your app.

Backwards Compatibility with Slack V2#

Slack V3 currently contains improvements to enhance the stability of the integration as well as the circumvention of OProxy. This version is intended to provide customers with more granular control over the Slack integration by enabling the Bring-Your-Own-App model and customizable scope-based authentication.

All commands are fully compatible with Slack V2 playbooks as their inputs and outputs have remained the same. As a customer, you should notice no significant change in the behavior of the Slack integration with your existing playbooks.

Commands#

You can execute these commands from the Cortex XSOAR CLI, as part of an automation, or in a playbook. After you successfully execute a command, a DBot message appears in the War Room with the command details.

mirror-investigation#


Mirrors the investigation between Slack and the Cortex XSOAR War Room.

Base Command#

mirror-investigation

Input#

Argument NameDescriptionRequired
typeThe mirroring type. Can be "all", which mirrors everything, "chat", which mirrors only chats (not commands), or "none", which stops all mirroring. Possible values are: all, chat, none. Default is all.Optional
autocloseWhether the channel is auto-closed when an investigation is closed. Can be "true" or "false". Default is "true".Optional
directionThe mirroring direction. Can be "FromDemisto", "ToDemisto", or "Both". Default value is "Both".Optional
mirrorToThe channel type. Can be "channel" or "group". The default value is "group".Optional
channelNameThe name of the channel. The default is "incident-<incidentID>".Optional
channelTopicThe topic of the channel.Optional
kickAdminWhether to remove the Slack administrator (channel creator) from the mirrored channel. Possible values are: true, false. Default is false.Optional

Context Output#

There is no context output for this command.

Command Example#

!mirror-investigation direction="FromDemisto" channelName="example" using-brand="SlackV3"

Human Readable Output#

Investigation mirrored successfully, channel:example

send-notification#


Sends a message to a user, group, or channel.

Base Command#

send-notification

Input#

Argument NameDescriptionRequired
messageThe message content. When mentioning another Slack user, make sure to do so in the following format: <@user_name>.Optional
toThe user to whom to send the message. Can be either the username or email address.Optional
channelThe name of the Slack channel to which to send the message.Optional
entryAn entry ID to send as a link.Optional
ignoreAddURLWhether to include a URL to the relevant component in Cortex XSOAR. Can be "true" or "false". Default value is "false".Optional
threadIDThe ID of the thread to which to reply. Can be retrieved from a previous send-notification command.Optional
blocksA JSON string of Slack blocks to send in the message.Optional

Context Output#

PathTypeDescription
Slack.Thread.IDStringThe Slack thread ID.

Command Example#

!send-notification channel="example" using-brand="SlackV3"

Context Example#

{
"Slack": {
"Thread": {
"ID": "1624272821.000700"
}
}
}

Human Readable Output#

Message sent to Slack successfully. Thread ID is: 1624272821.000700

close-channel#


Archives a Slack channel.

Base Command#

close-channel

Input#

Argument NameDescriptionRequired
channelThe name of the channel to archive. If not provided, the mirrored investigation channel is archived (if the channel exists).Optional

Context Output#

There is no context output for this command.

Command Example#

!close-channel channel=new-slack-channel

Human Readable Output#

Channel successfully archived.

slack-send-file#


Sends a file to a user, channel, or group. If not specified, the file is sent to the mirrored investigation channel (if the channel exists).

Base Command#

slack-send-file

Input#

Argument NameDescriptionRequired
fileThe ID of the file entry to send.Required
toThe user to whom to send the file. Can be the username or the email address.Optional
groupThe name of the Slack group (private channel) to which to send the file.Optional
channelThe name of the Slack channel to which to send the file.Optional
threadIDThe ID of the thread to which to reply. Can be retrieved from a previous send-notification command.Optional
commentA comment to add to the file.Optional

Context Output#

There is no context output for this command.

Command Example#

!slack-send-file file=87@129 channel=testing-docs comment="Look at this gif!"

Human Readable Output#

File sent to Slack successfully.

slack-set-channel-topic#


Sets the topic for a channel.

Base Command#

slack-set-channel-topic

Input#

Argument NameDescriptionRequired
channelThe channel name. If not specified, the topic of the mirrored investigation channel is set (if the channel exists).Optional
topicThe topic for the channel.Required

Context Output#

There is no context output for this command.

Command Example#

!slack-set-channel-topic topic="Testing topic for documentation" channel=testing-docs

Human Readable Output#

Topic successfully set.

slack-create-channel#


Creates a channel in Slack.

Base Command#

slack-create-channel

Input#

Argument NameDescriptionRequired
typeThe channel type. Can be "private" or "public". Default is private.Optional
nameThe name of the channel.Required
usersA CSV list of user names or email addresses to invite to the channel. For example: "user1, user2...".Optional

Context Output#

There is no context output for this command.

Command Example#

!slack-create-channel type="private" name="testing-docs"

Human Readable Output#

Successfully created the channel testing-docs

slack-invite-to-channel#


Invites users to join a channel.

Base Command#

slack-invite-to-channel

Input#

Argument NameDescriptionRequired
usersA CSV list of usernames or email addresses to invite to join the channel. For example: "user1, user2...".Required
channelThe name of the channel to which to invite the users. If the name of the channel is not specified, the name of the mirrored investigation channel is used (if the channel exists).Optional

Context Output#

There is no context output for this command.

Command Example#

!slack-invite-to-channel users="Sir Testing McTesterface" channel=new-slack-channel

Human Readable Output#

Successfully invited users to the channel.

slack-kick-from-channel#


Removes users from the specified channel.

Base Command#

slack-kick-from-channel

Input#

Argument NameDescriptionRequired
usersA CSV list of usernames or email addresses to remove from the a channel. For example: "user1, user2...".Required
channelThe name of the channel from which to remove the users. If the name of the channel is not specified, the mirrored investigation channel is used (if the channel exists).Optional

Context Output#

There is no context output for this command.

Command Example#

!slack-kick-from-channel users="Sir Testing McTesterface" channel=new-slack-channel

Human Readable Output#

Successfully kicked users from the channel.

slack-rename-channel#


Renames a channel in Slack.

Base Command#

slack-rename-channel

Input#

Argument NameDescriptionRequired
nameThe new name of the channel.Required
channelThe current name of the channel. If the name of the channel is not specified, the mirrored investigation channel is used (if the channel exists).Optional

Context Output#

There is no context output for this command.

Command Example#

!slack-rename-channel name="new-slack-channel" channel="testing-docs"

Human Readable Output#

Channel renamed successfully.

slack-get-user-details#


Get details about a specified user.

Base Command#

slack-get-user-details

Input#

Argument NameDescriptionRequired
userThe Slack user (username or email).Required

Context Output#

PathTypeDescription
Slack.User.IDStringThe ID of the user.
Slack.User.UsernameStringThe username of the user.
Slack.User.NameStringThe actual name of the user.
Slack.User.DisplayNameStringThe display name of the user.
Slack.User.EmailStringThe email address of the user.

Command Example#

!slack-get-user-details user="cortex_xsoar" using-brand="SlackV3"

Context Example#

{
"Slack": {
"User": {
"ID": "U0XXXXXXXX",
"Name": "cortex_xsoar",
"Username": "demisto_integration"
}
}
}

Human Readable Output#

Details for Slack user: cortex_xsoar#

IDUsernameName
U0XXXXXXXXdemisto_integrationcortex_xsoar

slack-edit-message#


Edit an existing Slack message.

Base Command#

slack-edit-message

Input#

Argument NameDescriptionRequired
channelThe channel the message is posted in.Optional
threadIDThe ID of the thread of which to edit - can be retrieved from a previous send-notification command.Required
messageThe updated message.Optional
blocksA JSON string of the block to send.Optional
ignore_add_urlWhether to include a URL to the relevant component in XSOAR. Can be "true" or "false". Default value is "false".Optional

Context Output#

PathTypeDescription
Slack.Thread.IDStringThe timestamp identifier for the message.
Slack.Thread.ChannelStringThe channel ID the message was posted in.
Slack.Thread.TextStringThe text the message was updated with.

Command Example#

!slack-edit-message channel="random" threadID="1629281551.001000" message="Eyy"

Context Example#

{
"Slack": {
"Thread": {
"ID": "1629281551.001000",
"Channel": "C0XXXXXXXX",
"Text": "Eyy"
}
}
}

Human Readable Output#

The message was successfully edited.

slack-pin-message#


Pins a selected message to the given channel.

Base Command#

slack-pin-message

Input#

Argument NameDescriptionRequired
channelThe channel the message is posted in.Optional
threadIDThe ID of the thread of which to pin - can be retrieved from a previous send-notification command.Required

Context Output#

There is no context output for this command.

Command Example#

!slack-pin-message channel=random threadID=1629281551.001000

Human Readable Output#

The message was successfully pinned.

Known Limitations#

SlackV3 mirrors incidents by listening to messages being sent in channels the bot has been added to. Because of this, you may have some users in Slack who are not users in XSOAR. This will occasionally cause the module health to indicate that an error has occurred because a user was unable to be found. In this circumstance, the error is expected and is purely cosmetic in nature.

Please note: If a dedicated channel is configured, however there are no notifications being sent, please verify that the Types of Notifications to send parameter is populated.