Slack | Marketplace

Details
Content
Dependencies
Version History

Interact with Slack API - collect logs, send messages and notifications to your Slack team.

Send messages and notifications to your Slack team and integrates with Slack's services to execute create, read, update, and delete operations for employee lifecycle processes.

What does this pack do?

Mirrors the investigation between Slack and the Cortex XSOAR War Room.
Sends a message to a user, group, or channel.
Archives a Slack channel.
Sends a file to a user, channel, or group.
Sets the topic for a channel.
Creates a channel in Slack.
Invites users to join a channel.
Removes users from the specified channel.
Renames a channel in Slack.
Gets details about a specified user.
Returns the integration context as a file (for debugging purposes only).

As part of this pack, you will get a playbook that investigates failed login events.

Send messages and notifications to your Slack team and integrates with Slack's services to execute create, read, update, and delete operations for employee lifecycle processes.

What does this pack do?

Mirrors the investigation between Slack and the Cortex XSIAM War Room.
Sends a message to a user, group, or channel.
Archives a Slack channel.
Sends a file to a user, channel, or group.
Sets the topic for a channel.
Creates a channel in Slack.
Invites users to join a channel.
Removes users from the specified channel.
Renames a channel in Slack.
Gets details about a specified user.
Returns the integration context as a file (for debugging purposes only).

As part of this pack, you will get a playbook that investigates failed login events.

Automations

Name	Description
SlackBlockBuilder	SlackBlockBuilder will format a given Slack block into a format readable by the SlackV3 integration. The script will also send the block to the given destination. Make sure to mark Trust any certificate and fill the XSOAR API Key integration parameters if you want to get a response to the incident context.
SlackAskV2	Sends a message (question) to either user (in a direct message) or to a channel. The message includes predefined reply options. The response can also close a task (might be conditional) in a playbook.
SlackAsk	Sends a message (question) to either user (in a direct message) or to a channel. The message includes predefined reply options. The response can also close a task (might be conditional) in a playbook.
GetSlackBlockBuilderResponse	GetSlackBlockBuilderResponse will format a SlackBlockBuilder response and insert it into an incident's context.

Classifiers

Name	Description
Slack Classifier
Slack Mapper

Integrations

Name	Description
Slack v3	Send messages and notifications to your Slack team.
Slack IAM	Integrate with Slack's services to execute CRUD operations for employee lifecycle processes.
Slack v2 (Deprecated)	Deprecated. Use SlackV3 instead.

Playbooks

Name	Description
Slack - General Failed Logins v2.1	Investigates a failed login event. The playbook interacts with the user via the Slack integration, checks whether the logins were a result of the user's attempts or an attack, raises the severity, and expires the user's password according to the user's replies.
SlackBlockBuilderResponseExample	This is an example of how to use the SlackBlockBuilder within a playbook.

Automations

Name	Description
GetSlackBlockBuilderResponse	GetSlackBlockBuilderResponse will format a SlackBlockBuilder response and insert it into an incident's context.
SlackAsk	Sends a message (question) to either user (in a direct message) or to a channel. The message includes predefined reply options. The response can also close a task (might be conditional) in a playbook.
SlackAskV2	Sends a message (question) to either user (in a direct message) or to a channel. The message includes predefined reply options. The response can also close a task (might be conditional) in a playbook.
SlackBlockBuilder	SlackBlockBuilder will format a given Slack block into a format readable by the SlackV3 integration. The script will also send the block to the given destination. Make sure to mark Trust any certificate and fill the XSOAR API Key integration parameters if you want to get a response to the incident context.

Classifiers

Name	Description
Slack Classifier
Slack Mapper

Integrations

Name	Description
Slack v3	Send messages and notifications to your Slack team.
Slack IAM	Integrate with Slack's services to execute CRUD operations for employee lifecycle processes.
Slack Event Collector	Slack logs event collector integration for XSIAM.
Slack v2 (Deprecated)	Deprecated. Use SlackV3 instead.

Modeling Rules

Name	Description
Slack Modeling Rule

Parsing Rules

Name	Description
Slack Parsing Rule

Playbooks

Name	Description
SlackBlockBuilderResponseExample	This is an example of how to use the SlackBlockBuilder within a playbook.
Slack - General Failed Logins v2.1	Investigates a failed login event. The playbook interacts with the user via the Slack integration, checks whether the logins were a result of the user's attempts or an attack, raises the severity, and expires the user's password according to the user's replies.

Required Content Packs (3)

Pack Name	Pack By
Base	By: Cortex XSOAR
Common Types	By: Cortex XSOAR
Filters And Transformers	By: Cortex XSOAR

Optional Content Packs (4)

Pack Name	Pack By
Active Directory Query	By: Cortex XSOAR
Microsoft Teams	By: Cortex XSOAR
Password Reset via Chatbot	By: Cortex XSOAR
Syslog	By: Cortex XSOAR

All level dependencies (4)

Pack Name	Pack By
Filters And Transformers	By: Cortex XSOAR
Cortex REST API	By: Cortex XSOAR
Common Types	By: Cortex XSOAR
Base	By: Cortex XSOAR

3.4.10 - 913451 (March 25, 2024)

Integrations

Slack IAM

Maintenance and stability enhancements.

Scripts

SlackBlockBuilder

Fixed an issue where the blocks were not parsed correctly, when the blocks_url argument contains more than one # symbol.
Updated the Docker image to: demisto/python3:3.10.13.90168.

Related pull requests:
- 31905

Download

3.4.8 - 876540 (March 7, 2024)

Scripts

SlackBlockBuilder

Added the thread_id input to the SlackBlockBuilder automation script to send replies to Slack threads. Added a SlackBlockBuilder context output key that holds the thread_id and other Slack metadata.
Updated the Docker image to: demisto/python3:3.10.13.89009.

Related pull requests:
- 33253
- 32965

Download

3.4.7 - 860237 (February 29, 2024)

Integrations

Slack v3

Fixed an issue where the send-notification command did not send the correct URL on Slack message.
Updated the Docker image to: demisto/slackv3:1.0.0.88538.

Related pull requests:
- 33113

Download

3.4.6 - 837109 (February 19, 2024)

Integrations

Slack v3

Added support for mirroring files from xsoar to slack.
Added the Enable Outbound File Mirroring integration parameter to allow file mirroring from xsoar to slack. The parameter is unchecked by default, disabling file mirroring.
Updated the Docker image to: demisto/slackv3:1.0.0.87650.

Related pull requests:
- 32611

Download

3.4.5 - 836299 (February 18, 2024)

Integrations

Slack IAM

Updated the Docker image to: demisto/python3:3.10.13.86272.

Related pull requests:
- 32446

Download

3.4.4 - 819156 (February 11, 2024)

Integrations

Slack v3

Updated the Docker image to: demisto/slackv3:1.0.0.86601.

Related pull requests:
- 32814

Download

3.4.3 - R798475 (February 1, 2024)

Scripts

GetSlackBlockBuilderResponse

Breaking changes: Fixed an issue where the first response is always selected.
Updated the Docker image to: demisto/python3:3.10.13.85667.

Related pull requests:
- 32363

Download

3.4.2 - 755215 (January 10, 2024)

Integrations

Slack v3

Fixed an issue where SlackAsk responses were not processed correctly.
Updated the Docker image to: demisto/slackv3:1.0.0.84782.

Scripts

SlackBlockBuilder

Fixed an issue where a unique action ID would be added to image blocks incorrectly.
Updated the Docker image to: demisto/python3:3.10.13.84405.

Related pull requests:
- 32108

Download

3.4.1 - 752611 (January 9, 2024)

Integrations

Slack v3

Added the incidentAssigned notification type to the available Permitted Notification Types options.
Updated the Docker image to: demisto/slackv3:1.0.0.83424.

Related pull requests:
- 31999

Download

3.4.0 - 721233 (December 27, 2023)

Changes are not relevant for XSOAR marketplace.

Related pull requests:
- 31528

Download

3.3.0 - 7190203 (December 17, 2023)

Integrations

Slack v3

Fixed an issue where SlackBlockBuilder responses would fail to be handled correctly when using the internal request method to update an incident's context.
SlackBlockBuilder no longer relies on the XSOAR API in order to update an incident's context. As such, playbooks which currently use the SlackBlockBuilder script should be modified as described in the documentation.
Additional information regarding the change and migrating from pack version 3.2.8 can be found here.
Updated the Docker image to: demisto/slackv3:1.0.0.83424.

Playbooks

New: SlackBlockBuilderResponseExample

New: This is an example of how to use the SlackBlockBuilder within a playbook.

Scripts

New: GetSlackBlockBuilderResponse

New: GetSlackBlockBuilderResponse will format a SlackBlockBuilder response and insert it into an incident's context.

Related pull requests:
- 31393

Download

3.2.7 - 7029664 (November 30, 2023)

Documentation and metadata improvements.
Updated the Docker image to: demisto/slackv3:1.0.0.73990.

Scripts

SlackBlockBuilder

Documentation and metadata improvements.
Updated the Docker image to: demisto/python3:3.10.13.73190.

Related pull requests:
- 29707

Download

3.2.1 - 6285754 (September 10, 2023)

Integrations

Slack v3

Fixed an issue where the mirror-investigation command created private channels when the private argument was set to true.
Updated the Docker image to: demisto/slackv3:1.0.0.73686.

Related pull requests:
- 29447

Download

3.2.0 - 6194926 (August 30, 2023)

Integrations

Slack v3

Added a new commands:
- slack-list-channels
- slack-get-conversation-history
- slack-get-conversation-replies
Updated the Docker image to: demisto/slackv3:1.0.0.72328.

Related pull requests:
- 29247
- 27985

Download

3.1.46 - 6086488 (August 18, 2023)

Integrations

Slack v3

Updated the Docker image to: demisto/slackv3:1.0.0.69226.

Related pull requests:
- 29050

Download

3.1.45 - 5950262 (August 3, 2023)

Integrations

Slack v3

Added a new command slack-user-session-reset.
Added the user_token integration parameter to allow admin permissions.
Updated the Docker image to: demisto/slackv3:1.0.0.66900.

Related pull requests:
- 28745
- 28538

Download

3.1.44 - 5914533 (July 31, 2023)

Scripts

SlackAskV2

Updated the Docker image to: demisto/python3:3.10.12.66339.

SlackAsk

Updated the Docker image to: demisto/python3:3.10.12.66339.

SlackBlockBuilder

Updated the Docker image to: demisto/python3:3.10.12.66339.

Related pull requests:
- 28606

Download

3.1.43 - R5866730 (July 25, 2023)

Changes are not relevant for XSOAR marketplace.

Related pull requests:
- 28076

Download

3.1.41 - R5723074 (July 9, 2023)

Integrations

Slack IAM

Updated the Docker image to: demisto/python3:3.10.12.63474.

Related pull requests:
- 27954

Download

3.1.40 - R5692327 (July 5, 2023)

Integrations

Slack v3

Updated the Docker image to: demisto/slackv3:1.0.0.63762.

Related pull requests:
- 27676

Download

3.1.39 - 5480230 (June 8, 2023)

Scripts

SlackAskV2

Updated the Docker image to: demisto/python3:3.10.12.62631.

Related pull requests:
- 27300

Download

3.1.38 - 5476421 (June 8, 2023)

Integrations

Slack v3

Updated the Docker image to: demisto/slackv3:1.0.0.62921.

Related pull requests:
- 27301

Download

3.1.37 - R5450895 (June 5, 2023)

Integrations

Slack v3

Updated the Docker image to: demisto/slackv3:1.0.0.61538.

Related pull requests:
- 26962

Download

3.1.36 - 5226855 (May 9, 2023)

Changes are not relevant for XSOAR marketplace.

Related pull requests:
- 26405

Download

3.1.35 - 5216377 (May 8, 2023)

Integrations

Slack v3

Added support for war room mentions.
Updated the Docker image to: demisto/slackv3:1.0.0.57577.

Related pull requests:
- 26383
- 26380

Download

3.1.34 - 5210973 (May 7, 2023)

Changes are not relevant for XSOAR marketplace.

Related pull requests:
- 26265
- 26253

Download

3.1.33 - 5185403 (May 4, 2023)

Integrations

Slack v3

Updated the Docker image to: demisto/slackv3:1.0.0.57155.

Related pull requests:
- 26293

Download

3.1.32 - R5170573 (May 2, 2023)

Classifiers

New: Slack Classifier

Added a new classifier for the Password Reset via Chatbot incident type (Available from Cortex XSOAR 6.8.0).

Mappers

New: Slack Mapper

Added a new mapper for the Password Reset via Chatbot incident type (Available from Cortex XSOAR 6.8.0).

Related pull requests:
- 23800

Download

3.1.31 - 5069026 (April 18, 2023)

Integrations

Slack v3

Fixed an issue where the Slack listener would miss some user messages when mirroring an incident.
Updated the Docker image to: demisto/slackv3:1.0.0.54956.

Related pull requests:
- 25913

Download

3.1.30 - 5006477 (April 10, 2023)

Integrations

Slack v3

Updated the Docker image to: demisto/slackv3:1.0.0.54631.
Fixed an issue when creating a new incident in XSOAR from the bot failed.
Added support for classification & mapping.

Related pull requests:
- 25666

Download

3.1.29 - 4935746 (March 30, 2023)

Integrations

Slack v3

Added externalFormSubmit as a default permitted notification type. In order to allow Ask tasks to be sent correctly,
please consider adding the externalFormSubmit permitted notification type to any existing SlackV3 instances you may already have.

- Updated the Docker image to: demisto/slackv3:1.0.0.52396.

Related pull requests:
- 25425

Download

PUBLISHER

Cortex

PLATFORMS

Cortex XSOARCortex XSIAM

INFO

Certification	Certified	Read more
Supported By	Cortex
Created	August 13, 2020
Last Release	March 25, 2024

WORKS WITH THE FOLLOWING INTEGRATIONS:

DISCLAIMER

Content packs are licensed by the Publisher identified above and subject to the Publisher’s own licensing terms. Palo Alto Networks is not liable for and does not warrant or support any content pack produced by a third-party Publisher, whether or not such packs are designated as “Palo Alto Networks-certified” or otherwise. For more information, see the Marketplace documentation.