Require user input to continue running the playbook using the classic playbook editor
You can configure a task or prompt in your playbook that must be acknowledged by a user before further actions in the playbook are run. You can configure the following types of user input in a playbook:
- A manual task using a Manual Task block that must be acknowledged by a user.
- A prompt using a Prompt block that must be acknowledged by a user. You can configure a specific response type with a Prompt block.
Require user input using the Manual Task block in your playbook
Use a Manual Task block to send a message to a user or group that they must acknowledge. This is the same as manually running a task action from the Investigation menu.
To configure a manual task, perform the following tasks:
- Drop a new block onto the playbook editor.
- Click on the block, then select Manual Task from the block types.
- Select an Approver from the drop-down list. If the task is assigned to a group of users, the first user to process it completes the task.
- From the Required response time field, choose the response time in minutes.
- In the Message box, craft a meaningful message so the users receiving the message understand what actions they must take.
Require user input using the Prompt block in your playbook
Use a Prompt block in your playbook to send a message to a user or group that they must acknowledge.
To configure a prompt, perform the following tasks:
- Drop a new block onto the playbook editor.
- Click on the block, and then select Prompt from the block types.
- Select an Approver from the drop-down list. If the task is assigned to a group of users, the first user to process it completes the task.
- From the Required response time field, choose the response time in minutes.
- In the Message box, craft a meaningful message so the users receiving the message understand what actions they must take. Markdown is supported.
- From the Responses drop-down list, choose the type of response required to complete the task. If the response type is Message, markdown is supported.
See https://guides.github.com/features/mastering-markdown/ for more information on the type of Markdown that can be used in the Message box.
Customize the format of your playbook content using the classic playbook editor | Set container parameters in using the API block with the classic playbook editor |
This documentation applies to the following versions of Splunk® SOAR (On-premises): 5.0.1
Feedback submitted, thanks!