Interaction Tasks

a. Question types: The format of user input.

• A long text question is included by default

READER NOTE

Refer to the Appendix for the complete list of question types.

b. Question input: The prompt to which users respond.

READER NOTE

Each question must be uniquely phrased, even if the question type differs.

c. Dynamic question toggle: Enables users to construct questions dynamically using the data formatter popover.

READER NOTE

See to Dynamically Selecting Data for more information.

d. Set default value toggle: Allows users to define a pre-filled placeholder answer for a question.

• Clicking the icon opens the data formatter popover, allowing users to dynamically insert a placeholder value, either text, table, or whatever data type dynamically selected.

READER NOTE *

• See to Dynamically Selecting Data for more information.

• See Using an Interaction Task to Request Analyst Input on Check Reputation Results.

e. icon: Opens a confirmation pop-up to confirm the deletion of the selected question.

f. Read-only toggle: Makes the question non-editable, allowing information to be displayed without requiring a response.

g. Required toggle: Ensures the question must be answered before the task can be completed.

Reply in Pending Task: Assignees can respond by navigating to the Pending Tasks tab in the Investigation Dashboard module or within the incident workspace.

• The task must be assigned to a user, role, or group in vSOC, or to the incident owner or investigator, with a defined due time.

  

Investigation Dashboard

Assigned users can open the Investigation Dashboard module, expand the Pending Tasks accordion, select a view option (e.g., All Pending Tasks), and click into the task to respond.

Incident Workspace

Within the incident workspace, users can respond to an assigned task on the Pending Tasks sub-module.

To respond to an interaction task, assigned users can answer the questions and click the Run button.

Users should use the Skip button with caution, as some downstream tasks may depend on the interaction task's output for successful execution.

Reply in Email: Assignees can respond by clicking on a link sent to their email.

• Only the first submission will be recorded, and any additional submissions will be ignored.

• Users cannot respond to the interaction task via the sent link if the due date has passed.

  

Refer to the Using an Interaction Task to Investigate Unrecognized Users example for a demonstration.

• Create Interaction Response Link: Generates a link to a form with the interaction task's questions, retrievable from the task's return data at $.Data.ResponseURL. Allows setting a due time for responses.

  

  • Only the first submission will be recorded, and any additional submissions will be ignored.

• Await Interaction Response Result: Waits for form submission via the link generated by Create Interaction Response Link.

  

  • Users cannot submit responses via the interaction response link after the due date has passed.

    

Suppose the following investigation playbook is provided:

1. Set up the first interaction task.

   

2. Set up the second interaction task.

   

3. Test the playbook, then click on the icon for the first interaction task to obtain the response URL.

   

4. Send the URL to the relevant recipients. The form accessed via the URL will appear as follows:

   

5. Click on the icon for the second interaction task to check on the response status.

   • If the recipient does not respond within the allotted timeframe, an overdue message will be displayed in the Key Fields and Context Data tabs.

     

     

   • If the recipient responds by submitting the form within the allotted timeframe, their response will be displayed in the Key Fields and Context Data tabs.

     

     

     

     

SCENARIO An analyst aims to create a playbook that lists Slack users and prompts assignees to flag unrecognized accounts.

Here is how the analyst can design the initial tasks of the playbook:

1. Add the List Users command task from Slack to the On Playbook Start trigger, and configure it.

   

2. Click on the Test Playbook button, then click on the the Run Test button in the popover.

   

   This step helps reveal additional fields for dynamic data selection in step 7.

3. Add an interaction task to the previous task.

   

4. Name the task, then click the + Add button.

   

5. Use the icon to delete the default content.

   

6. Add a checkbox question with options generated dynamically from the List Slack Users task output.

   

   1. Click the Add button.

   2. Select Checkbox using the dropdown.

   3. Enter the question.

   4. Select the Dynamic toggle.

   5. Click the icon.

7. Select data dynamically, then save the task.

   

   1. Open the Slack command task object.

   2. Open the outputData object.

   3. Select the Usernames field.

   4. Click on the Save button.

8. Mark this question as required, then click on the Save button.

   

9. Configure the interaction task to be sent and responded to via email, then save the task.

   

   1. Select the Reply in Email option as the Reply Channel.

   2. Enter the recipient's email address.

   3. Enter the email subject.

   4. Enter the email content.

   5. Set a due time.

   6. Click the button to save the task.

10. Click the button to stop the playbook test and restore the Test Playbook button.

11. Click on the Test Playbook button, then click on the the Run Test button in the popover.

    

RESULT

The playbook executes the auto-run List Slack Users task.

The execution pauses at the Flag Unrecognized Users task, as indicated by the icon.

The email recipient specified in the interaction task can access it in form format by clicking the URL in the email body.

The recipient can respond to the interaction task using the form.

Once the form has been submitted, the icon changes to the icon, indicating that the task is finished.

SCENARIO An L1 analyst wants input from an L2 analyst on the risk level of IP addresses.

Here is how the L1 analyst can design the playbook, using interaction tasks in combination with command tasks:

1. Add a command task that can check the reputation of IP addresses (e.g., the Check IP Reputation command from Anomali Threatstream) to the On Playbook Start trigger, and configure it.

   

2. Add an interaction task to the previous task.

   

3. Name the task, then click the + Add button.

   

4. Use the icon to delete the default content.

   

5. Add an HTML text question to display the check reputation task's result table.

   

   1. Click the Add button.

   2. Select HTML Text using the dropdown.

   3. Enter the question.

   4. Select the Set default value toggle.

   5. Click the icon to use the data formatter to dynamically select data for the result table of the command task.

      CODE

      {{PlaybookData | jsonpath('$.["Check IP Reputation"].result')}}

   6. Select the Read-Only toggle.

6. Add a radio button question.

   

   1. Click the Add button.

   2. Select Radio Button using the dropdown.

   3. Enter the question.

   4. Add the options.

   5. Mark this as required.

7. Add a short text question to allow the L2 analyst to add a short comment, then save.

   

   1. Click the Add button.

   2. Select Short Text using the dropdown.

   3. Enter the question.

   4. Click on the Save button.

8. Create a response link, then save the task.

   

   1. Select the Create Interaction Response Link option as the reply channel.

   2. (Optional) Add a title for the form.

   3. (Optional) Add a message to clarify the intention of the form.

   4. Click the button to save the task.

9. Click on the Test Playbook button, then click on the the Run Test button in the popover.

   

   This step helps reveal additional fields for dynamic data selection in step 13.

10. Add the Send Email utility command task to the previous interaction task.

    

11. Enter the recipient's email address and the subject.

    

12. Paste the code snippet in the email body, then click the icon to construct the email message.

    

    CODE

    <p>Hi Jane,</p>
    
    <p>Please review and respond to the required form at your earliest convenience.</p>
    
    <p>Click the link below to access the form:</p>
    
    <p><a href="placeholder">Form Link</a></p>
    
    <p>Your timely response is appreciated.</p>
    
    <p>Best regards,</p>
    
    <p>John</p>

13. Dynamically select the data containing the response link.

    

    1. Click the icon.

    2. Open the object containing the task that generated the response link.

    3. Open the returnData object.

    4. Open the Data object.

    5. Select the path containing the response link.

    6. Click the Generate button.

14. Replace placeholder in the code with the variable, then click the Save button.

    

    Ensure that the variable is enclosed in double-quotes.

15. Select the checkbox, then click the button to save.

    

16. Add another interaction task following the Send Email task to set a due time for the L2 analyst to respond to the form.

    

17. Name the task, then select the Await Interaction Response Result option as the reply channel.

    

18. Dynamically select the response link.

    

    Refer to step 13 for details.

19. Enter the due time (in minutes) for the preceding interaction task, then click the button to save the task.

    

20. Click the button to stop the playbook test and restore the Test Playbook button.

21. Click on the Test Playbook button, then click on the the Run Test button in the popover.

    

RESULTS

The playbook executes from left to right, processing auto-run tasks and the first interaction task, which was configured to generate a response form link.

The execution pauses at the last task—Set Due Time to Respond—indicated by the icon.

The email recipient of the Send Email task can access the interaction task in form format by clicking the Form Link in the email body.

The recipient can respond to the interaction task using the form.

Once the form has been submitted, the icon changes to the icon, indicating that the task is finished.