Skip to main content


This Script is part of the Slack Pack.#

Supported versions

Supported Cortex XSOAR versions: 5.5.0 and later.

Sends a message (question) to either user (in a direct message) or to a channel. The message includes predefined reply options. The response can also close a task (might be conditional) in a playbook.

SlackAskV2 was added to support the release of SlackV3 is only compatible with SlackV3.

Script Data#

Script Typepython3
Demisto Version5.5.0

Use Case#

This automation allows you to ask users in Slack (including external to Cortex XSOAR) questions, have them respond and reflect the answer back to Cortex XSOAR.


Requires an instance of the SlackV3 integration.

This script uses the following commands and scripts.

  • send-notification


Argument NameDescription
userThe Slack user to which to send the message. Can be either an email address or a Slack user name.
channelThe Slack channel to which to send the message.
messageThe message to send to the user or channel.
option1The first reply option. The default is "Yes" with a green button. To change the color of the button, add the pound sign (#) followed by the name of the new color (green, red, or black). The default color is "green". For example, "Yes#green".
option2The second reply option. The default is "No" with a red button. To change the button color, add the pound sign (#) followed by the name of the new color (green, red, or black). The default color is "red". For example, "No#red".
taskThe task to close with the reply. If empty, then no playbook tasks will be closed.
replyEntriesTagTag to add to email reply entries.
persistentIndicates whether to use one-time entitlement or persistent entitlement.
responseTypeHow the user should respond to the question.
additionalOptionsA comma-separated list of additional options in the format of "option#color", for example, "maybe#red". The default color is "black".
replyThe reply to send to the user. Use the templates {user} and {response} to incorporate these in the reply. (i.e. "Thank you {user}. You have answered {response}.")
lifetimeTime until the question expires. For example - 1 day. When it expires, a default response is sent.
defaultResponseDefault response in case the question expires.
slackInstanceThe instance of SlackV3 this script should use.
slackVersionThe version of Slack to use. SlackV3 is configured by default.


There are no outputs for this script.


The automation is most useful in a playbook to determine the outcome of a conditional task - which will be one of the provided options. It uses a mechanism that allows external users to respond in Cortex XSOAR (per investigation) with entitlement strings embedded within the message contents. SlackAsk

The automation can utilize the interactive capabilities of Slack to send a form with buttons - this requires the external endpoint for interactive responses to be available for connection (See the SlackV3 integration documentation for more information). You can also utilize threads instead, simply by specifying the responseType argument.


  • When using the replyEntriesTag argument, the persistent argument must be set to True.
  • SlackAskV2 will not work when run in the playbook debugger. This is because the debugger does not generate entitlements, since they must be tied to an investigation. Entitlements are needed to track the response.