For details, see:
Require user input to continue running the playbook using the classic playbook editor
You can configure a task or prompt in your playbook that must be acknowledged by a user before further actions in the playbook are run. You can configure the following types of user input in a playbook:
- A manual task using a Manual Task block that must be acknowledged by a user.
- A prompt using a Prompt block that must be acknowledged by a user. You can configure a specific response type with a Prompt block.
Require user input using the Manual Task block in your playbook
Use a Manual Task block to send a message to a user or group that they must acknowledge. This is the same as manually running a task action from the Investigation menu.
To configure a manual task, perform the following tasks:
- Drop a new block onto the playbook editor.
- Click on the block, then select Manual Task from the block types.
- Select an Approver from the drop-down list. If the task is assigned to a group of users, the first user to process it completes the task.
- From the Required response time field, choose the response time in minutes.
- In the Message box, craft a meaningful message so the users receiving the message understand what actions they must take.
Require user input using the Prompt block in your playbook
Use a Prompt block in your playbook to send a message to a user or group that they must acknowledge.
To configure a prompt, perform the following tasks:
- Drop a new block onto the playbook editor.
- Click on the block, and then select Prompt from the block types.
- Select an Approver from the drop-down list. If the task is assigned to a group of users, the first user to process it completes the task.
- From the Required response time field, choose the response time in minutes.
- In the Message box, craft a meaningful message so the users receiving the message understand what actions they must take. Markdown is supported.
- From the Responses drop-down list, choose the type of response required to complete the task. If the response type is Message, markdown is supported.
See https://guides.github.com/features/mastering-markdown/ for more information on the type of Markdown that can be used in the Message box.
Customize the format of your playbook content using the classic playbook editor | Set container parameters in using the API block with the classic playbook editor |
This documentation applies to the following versions of Splunk® SOAR (On-premises): 5.1.0, 5.2.1, 5.3.1, 5.3.2, 5.3.3, 5.3.4, 5.3.5, 5.3.6, 5.4.0, 5.5.0, 6.0.0, 6.0.1, 6.0.2, 6.1.0, 6.1.1, 6.2.0, 6.2.1, 6.2.2, 6.3.0, 6.3.1
Feedback submitted, thanks!