Skip to main content

DLP - Get User Feedback via Email

This Playbook is part of the Enterprise DLP by Palo Alto Networks Pack.#

Supported versions

Supported Cortex XSOAR versions: 6.8.0 and later.

Get the user feedback via email on a blocked file, whether it is false or true positive and if an exemption is needed.


This playbook uses the following sub-playbooks, integrations, and scripts.


This playbook does not use any sub-playbooks.






  • setIncident
  • pan-dlp-update-incident

Playbook Inputs#

NameDescriptionDefault ValueRequired
UserDisplayNameThe display name of the user.Optional
data_profile_nameThe name of the DLP data profile that detected the violation.Optional
file_nameThe name of the file that triggered the incident.Optional
question_typeWhether to ask the user about the file content or about an exemption.Optional
SendMailInstanceThe name of the instance to be used when executing the "send-mail" command in the playbook. In case it will be empty, all available instances will be used (default).Optional
UserEmailThe user email address.Optional
SnippetsThe snippets of the violation.Optional

Playbook Outputs#

UserRequestedExemptionWhether the user requested exemption or not.unknown

Playbook Image#

DLP - Get User Feedback via Email