Skip to main content


This Script is part of the Enterprise DLP by Palo Alto Networks Pack.#

Supported versions

Supported Cortex XSOAR versions: 5.5.0 and later.

Sends a message via Slack to the user whose file upload violated DLP policies and triggered the incident.

Script Data#

Script Typepython3
Cortex XSOAR Version5.5.0


This script uses the following commands and scripts.

  • send-notification

Used In#

This script is used in the following playbooks and scripts.

  • DLP Incident Feedback Loop


Argument NameDescription
messengerThe messenger to use for sending notification,
file_nameThe name of the file that triggered the incident.
data_profile_nameThe name of the DLP data profile that detected the violation.
app_nameThe application that performed the upload.
taskA manual task that this task can close.
user_display_nameThe user name displayed in the Slack message.
user_idThe user ID to identify the recipient in Slack.
snippetsThe snippets of the violation.
include_violation_detailWhether to include violation details in the message.
question_typeWhether to ask the user about the file content or about exemption.


There are no outputs for this script.