Skip to main content
Skip table of contents

Interaction Tasks

LAST UPDATED: MAR 12, 2025

Interaction tasks introduces controlled decision points within automated workflows, ensuring human input is captured before execution continues. Incorporating human judgment balances automation with necessary oversight.

image 30 (3)-20250221-185506.png

Interaction Tasks.drawio (2)-20250311-212151.png

Building Questions

Group 163.png

Clicking the Frame 30-20250311-021142.png button in the Question Builder section opens the Interaction Task Questions popover.

Interaction Task Questions Popover
Frame 6 (1)-20250311-234826.png

a. Question types: The format of user input.

  • A long text question is included by default

READER NOTE

Refer to the Appendix for the complete list of question types.

b. Question input: The prompt to which users respond.

READER NOTE

Each question must be uniquely phrased, even if the question type differs.

c. Dynamic question toggle: Enables users to construct questions dynamically using the data formatter popover.

Group 7 (1).png

READER NOTE

See to Dynamically Selecting Data for more information.

d. Set default value toggle: Allows users to define a pre-filled placeholder answer for a question.

Frame 7 (1)-20250312-002316.png
  • Clicking the Anno ellipses.png icon opens the data formatter popover, allowing users to dynamically insert a placeholder value, either text, table, or whatever data type dynamically selected.

e. Frame 5.png icon: Opens a confirmation pop-up to confirm the deletion of the selected question.

image 22-20250312-002540.png

f. Read-only toggle: Makes the question non-editable, allowing information to be displayed without requiring a response.

g. Required toggle: Ensures the question must be answered before the task can be completed.

Selecting a Reply Channel

The reply channel defines the method assignees use to respond to the interaction task.

Reply in Pending Task

Reply in Pending Task: Assignees can respond by navigating to the Pending Tasks tab in the Investigation Dashboard module or within the incident workspace.

Group 129.png
  • The task must be assigned to a user, role, or group in vSOC, or to the incident owner or investigator, with a defined due time.

    Group 156.png

Investigation Dashboard

Assigned users can open the Investigation Dashboard module, expand the Pending Tasks accordion, select a view option (e.g., All Pending Tasks), and click into the task to respond.

Group 110 (1).png

Incident Workspace

Within the incident workspace, users can respond to an assigned task on the Pending Tasks sub-module.

Group 130 (1).png

To respond to an interaction task, assigned users can answer the questions and click the Run button.

Group 177.png

Users should use the Skip button with caution, as some downstream tasks may depend on the interaction task's output for successful execution.

Group 178.png
Reply in Email

Reply in Email: Assignees can respond by clicking on a link sent to their email.

Group 157.png
  • Only the first submission will be recorded, and any additional submissions will be ignored.

  • Users cannot respond to the interaction task via the sent link if the due date has passed.

    Group 171.png

Refer to the Using an Interaction Task to Investigate Unrecognized Users example for a demonstration.

Create Interaction Response Link | Await Interaction Response Result
image 21-20250311-214631.png
  • Create Interaction Response Link: Generates a link to a form with the Interaction task's questions, retrievable from the task’s return data at $.Data.ResponseURL. Allows setting a due time for responses.

    image 23-20250312-011101.png
    • Only the first submission will be recorded, and any additional submissions will be ignored.

  • Await Interaction Response Result: Waits for form submission via the link generated by Create Interaction Response Link.

    image 24-20250312-011127.png
    • Users cannot submit responses via the interaction response link after the due date has passed.

      Group 171.png

Examples

Example 1 - Create Interaction Response Link | Await Interaction Response Result

Suppose the following investigation playbook is provided:

  1. Set up the first interaction task.

    Frame 7.png
  2. Set up the second interaction task.

    Frame 75-20250310-230204.png
  3. Test the playbook, then click on the Frame 3.png icon for the first interaction task to obtain the response URL.

    Frame 18.png
  4. Send the URL to the relevant recipients. The form accessed via the URL will appear as follows:

    lab190.d3securityonline.net_16_8_VSOC_IT_CmdLxRmtRkyVD8ebDvmxvQ (1) 1 (1).png
  5. Click on the Frame 3.png icon for the second interaction task to check on the response status.

    • If the recipient does not respond within the allotted timeframe, an overdue message will be displayed in the Key Fields and Context Data tabs.

      Frame 19.png

      Frame 20.png
    • If the recipient responds by submitting the form within the allotted timeframe, their response will be displayed in the Key Fields and Context Data tabs.

      Frame 22.png
      lab190.d3securityonline.net_16_8_VSOC_IT_TgYQCg0ia0OgT0q8XU9L3w (1) 1.png
      Frame 15.png
      Frame 21.png
Example 2 - Using an Interaction Task to Investigate Unrecognized Users

SCENARIO An analyst aims to create a playbook that lists Slack users and prompts assignees to flag unrecognized accounts.

Group 164.png

Here is how the analyst can design the initial tasks of the playbook:

  1. Add the List Users command task from Slack to the On Playbook Start trigger, and configure it.

    send new list users.gif
  2. Click on the Test Playbook button, then click on the the Run Test button in the popover.

    Group 2 (1).png
    This step helps reveal additional fields for dynamic data selection in step 7.

  3. Add an interaction task to the previous task.

    add flag unrecognized users new.gif
  4. Name the task, then click the + Add button.

    Group 165 (1).png
  5. Use the Frame 5.png icon to delete the default content.

    Group 121 (2).png
  6. Add a checkbox question with options generated dynamically from the List Slack Users task output.

    Group 151 (1).png
    1. Click the Add button.

    2. Select Checkbox using the dropdown.

    3. Enter the question.

    4. Select the Dynamic toggle.

    5. Click the Anno ellipses.png icon.

  7. Select data dynamically, then save the task.

    Group 152.png
    1. Open the Slack command task object.

    2. Open the outputData object.

    3. Select the Usernames field.

    4. Click on the Save button.

  8. Mark this question as required, then click on the Save button.

    Group 153.png
  9. Configure the interaction task to be sent and responded to via email, then save the task.

    Group 155.png
    1. Select the Reply in Email option as the Reply Channel.

    2. Enter the recipient’s email address.

    3. Enter the email subject.

    4. Enter the email content.

    5. Set a due time.

    6. Click the Group 136 (1).png button to save the task.

  10. Click the button to stop the playbook test and restore the Test Playbook button.

  11. Click on the Test Playbook button, then click on the the Run Test button in the popover.

    Group 2 (1).png

RESULT

The playbook executes the auto-run List Slack Users task.

list slack users executed.gif

The execution pauses at the Flag Unrecognized Users task, as indicated by the Frame 4.png icon.

Group 173.png

The email recipient specified in the interaction task can access it in form format by clicking the URL in the email body.

Group 175.png

The recipient can respond to the interaction task using the form.

form unrecognized users.gif

Once the form has been submitted, the Frame 4.png icon changes to the Frame 3.png icon, indicating that the task is finished.

Group 176.png
Example 3 - Using an Interaction Task to Request Analyst Input on Check Reputation Results

SCENARIO An L1 analyst wants input from an L2 analyst on the risk level of IP addresses.

Group 172.png

Here is how the L1 analyst can design the playbook, using interaction tasks in combination with command tasks:

  1. Add a command task that can check the reputation of IP addresses (e.g., the Check IP Reputation command from Anomali Threatstream) to the On Playbook Start trigger, and configure it.

    add check ip new.gif
  2. Add an interaction task to the previous task.

    add interaction to check ip new.gif
  3. Name the task, then click the + Add button.

    Group 166 (2).png
  4. Use the Frame 5.png icon to delete the default content.

    Group 121 (2).png
  5. Add an HTML text question to display the check reputation task’s result table.

    Group 122 (2).png
    1. Click the Add button.

    2. Select HTML Text using the dropdown.

    3. Enter the question.

    4. Select the Set default value toggle.

    5. Click the Anno ellipses.png icon to use the data formatter to dynamically select data for the result table of the command task.

      CODE
      {{PlaybookData | jsonpath('$.["Check IP Reputation"].result')}}
    6. Select the Read-Only toggle.

  6. Add a radio button question.

    Group 123 (1).png
    1. Click the Add button.

    2. Select Radio Button using the dropdown.

    3. Enter the question.

    4. Add the options.

    5. Mark this as required.

  7. Add a short text question to allow the L2 analyst to add a short comment, then save.

    Group 140.png
    1. Click the Add button.

    2. Select Short Text using the dropdown.

    3. Enter the question.

    4. Click on the Save button.

  8. Create a response link, then save the task.

    Group 141.png
    1. Select the Create Interaction Response Link option as the reply channel.

    2. (Optional) Add a title for the form.

    3. (Optional) Add a message to clarify the intention of the form.

    4. Click the Group 136 (1).png button to save the task.

  9. Click on the Test Playbook button, then click on the the Run Test button in the popover.

    Group 2 (1).png

    This step helps reveal additional fields for dynamic data selection in step 13.

  10. Add the Send Email utility command task to the previous interaction task.

    add send email to l2 input new.gif
  11. Enter the recipient’s email address and the subject.

    Group 143.png
  12. Paste the code snippet in the email body, then click the Anno ellipses.png icon to construct the email message.

    Group 144 (1).png
    CODE
    <p>Hi Jane,</p>
    
    <p>Please review and respond to the required form at your earliest convenience.</p>
    
    <p>Click the link below to access the form:</p>
    
    <p><a href="placeholder">Form Link</a></p>
    
    <p>Your timely response is appreciated.</p>
    
    <p>Best regards,</p>
    
    <p>John</p>
  13. Dynamically select the data containing the response link.

    Group 145.png
    1. Click the Frame 2.png icon.

    2. Open the object containing the task that generated the response link.

    3. Open the returnData object.

    4. Open the Data object.

    5. Select the path containing the response link.

    6. Click the Generate button.

  14. Replace placeholder in the code with the variable, then click the Save button.

    replaceplaceholder.gif

    Ensure that the variable is enclosed in double-quotes.

  15. Select the Auto Run checkbox, then click the Group 147.png button to save.

    Group 146.png
  16. Add another interaction task following the Send Email task to set a due time for the L2 analyst to respond to the form.

    add another interaction task new.gif
  17. Name the task, then select the Await Interaction Response Result option as the reply channel.

    Group 167 (1).png
  18. Dynamically select the response link.

    Group 148.png

    Refer to step 13 for details.

  19. Enter the due time (in minutes) for the preceding interaction task, then click the Group 136 (1).png button to save the task.

    Group 139.png
  20. Click the button to stop the playbook test and restore the Test Playbook button.

  21. Click on the Test Playbook button, then click on the the Run Test button in the popover.

    Group 2 (1).png

RESULTS

The playbook executes from left to right, processing auto-run tasks and the first interaction task, which was configured to generate a response form link.

playbook executing 1.gif

The execution pauses at the last task—Set Due Time to Respond—indicated by the Frame 4.png icon.

Group 169.png

The email recipient of the Send Email task can access the interaction task in form format by clicking the Form Link in the email body.

Group 168.png

The recipient can respond to the interaction task using the form.

submit form new.gif

Once the form has been submitted, the Frame 4.png icon changes to the Frame 3.png icon, indicating that the task is finished.

Group 170.png

Appendix

Question Types

image 1 (1).png

Short Text

Allows users to input a concise textual answer.

Group 37.png
image 2.png

Long Text

Allows users to input a detailed textual answer.

Group 17 (1).png
image 3.png

HTML Text

Allows users to format responses using a rich-text (WYSIWYG) editor. Click the Group 10.png button to edit the source code using HTML and inline CSS.

Group 12.png
HTML
<div style="max-width: 600px; margin: auto; background: #5B1C97; padding: 20px; border-radius: 8px; box-shadow: 0px 2px 5px rgba(0,0,0,0.1);">
  <p style="font-size: 16px;">Subject: Re: Phishing Email Click Status</p>
  <p>Hi [Name],</p>
  <p>We have reviewed the phishing email activity, and based on our logs:</p>
  <ul>
    <li>
      <strong>Click Status:</strong>
      <span style="color: #d9534f;">Yes, the link was clicked.</span>
    </li>
    <li>
      <strong>Time of Click:</strong> [Timestamp]
    </li>
    <li>
      <strong>Device Used:</strong> [Device Info]
    </li>
  </ul>
  <p>Since the link was accessed, we have initiated the following actions:</p>
  <ul>
    <li>Flagged the affected account for monitoring.</li>
    <li>Scanned the system for potential threats.</li>
    <li>Instructed the user to reset their credentials as a precaution.</li>
  </ul>
  <p>If further investigation or remediation is required, please let us know.</p>
  <p>Best,</p>
  <p>
    <strong>[Your Name]</strong>
    <br />[Your Position] <br />[Your Organization]
  </p>
</div>
image 4.png

Checkbox

Allows users to select one or multiple options. To add options, enter each name on a new line.

Group 18.png
image 5.png

Radio Button

Allows users to select a single predefined choice. To add options, enter each name on a new line.

Group 21.png
image 6.png

Boolean

Allows users to respond with a True or False selection.

Group 17.png
image 7.png

Dropdown

Allows users to select a single option from a collapsible list. To add options, enter each name on a new line.

Group 25.png
image 8.png

JSON

Allows users to enter structured data in JSON format.

Group 26 (2).png

image 9.png

Number

Allows users to enter a numerical value.

Group 29.png
image 10.png

Date

Allows users to choose a date.

Group 32.png
image 11.png

Time

Allows users to choose a specific time.

Group 34.png
image 12.png

Date and Time

Allows users to choose both a date and time.

Group 36.png

JavaScript errors detected

Please note, these errors can depend on your browser setup.

If this problem persists, please contact our support.