Sends a message (question) to either user (in a direct message) or to a channel. The message includes predefined reply options. The response can also close a task (might be conditional) in a playbook.

Use Case

This automation allows you to ask users in Slack(including external to Demisto) questions, have them respond and reflect the answer back to Demisto.


Requires an instance of the Slack v2 integration.


Argument Name Description Required
user The Slack user to which to send the message. Can be either an email address or a Slack user name. Optional
channel The Slack channel to which to send the message. Optional
message The message to send to the user or channel. Required
replyEntriesTag Tag to add to email reply entries. Optional
responseType How the user should response to the question. Default is "buttons". Optional
additionalOptions A comma-separated list of additional options in the format of "option#color", for example, "maybe#red". The default color is "black". Optional
reply The reply to send to the user. Default is "Thank you for your response.". Optional
lifetime Time until the question expires. For example - 1 day. When it expires, a default response is sent. Optional
defaultResponse Default response in case the question expires. Default is "NoResponse". Optional


The automation is most useful in a playbook to determine the outcome of a conditional task - which will be one of the provided options. It uses a mechanism that allows external users to respond in Demisto(per investigation) with entitlement strings embedded within the message contents.
The automation can utilize the interactive capabilities of Slack to send a form with buttons - this requires the external endpoint for interactive responses to be available for connection (See the Slack v2 intergation documentation for more information). You can also utilize threads instead, simply by specifying the responseType argument.