Skip to content

Commit fb17487

Browse files
mmhwjulieschwartz18hyaffe839
authored
[Slack] Update the README with information about the Slack <> AgentiX feature (#44126)
* [Slack] Update the README with information about the Slack <> AgentiX feature * Apply suggestions from code review Co-authored-by: julieschwartz18 <91824591+julieschwartz18@users.noreply.github.com> * Apply suggestion from @mmhw * Bump slack version + RN * docker image and rn * Update RN --------- Co-authored-by: julieschwartz18 <91824591+julieschwartz18@users.noreply.github.com> Co-authored-by: hyaffe <hyaffe@paloaltonetworks.com>
1 parent 7982651 commit fb17487

6 files changed

Lines changed: 112 additions & 3 deletions

File tree

Packs/Slack/Integrations/SlackV3v2/README.md

Lines changed: 82 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -142,7 +142,88 @@ messages and the steady flow of the integration.**
142142
2. Navigate to your Instance Settings page in Cortex XSOAR and click **Test**. A message should appear in the channel
143143
from your app.
144144

145-
## Backwards Compatibility with Slack V2
145+
## Cortex Agentic Assistant in Slack
146+
147+
The Slack integration allows users to interact with the **Cortex Agentic Assistant** directly from Slack. Users can mention the bot in any channel or thread to ask security questions, run investigations, and receive AI-powered responses, all without leaving Slack.
148+
149+
![Cortex AI Assistant in Slack](../../doc_files/slack_ai_assistant_demo.png)
150+
151+
### Prerequisites
152+
153+
Before you begin, ensure the following requirements are met:
154+
155+
1. **Supported Cortex product version** — The tenant must be running one of the following versions (or later), depending on your product:
156+
157+
| Product | Minimum Version |
158+
|---------|-----------------|
159+
| Cortex AGENTIX | V1.3 |
160+
| Cortex Platform | 1.5 |
161+
| Cortex CLOUD | 2.1 |
162+
| Cortex XDR | 3.18 / 5.1 |
163+
| Cortex XSIAM | 2.10 / 3.5 |
164+
165+
2. **Slack App installed** — The Slack app must be created and installed in your workspace as described in [Creating a Custom App](#creating-a-custom-app) and [Installing the App to Your Workspace](#installing-the-app-to-your-workspace).
166+
3. **Slack content pack version 3.6.0 or later** — This includes the SlackV3 integration.
167+
4. **User permissions** — Each Slack user who interacts with the Cortex Agentic Assistant must have the appropriate permissions to use the Cortex Agentic Assistant in the Cortex platform. Users without the required permissions will receive an error message when attempting to interact with the bot. Contact your Cortex administrator to ensure the relevant roles and permissions are assigned.
168+
169+
### How to Enable
170+
171+
To enable this feature, configure the following in the integration instance settings.
172+
173+
1. Check **Enabled AI assistant**.
174+
2. **Long running instance** — The **Long running instance** checkbox must be enabled in the instance settings (required for listening to bot mentions in real time).
175+
176+
### How It Works
177+
178+
Once the prerequisites are met, users can interact with the Cortex Agentic Assistant by mentioning the bot (for example, `@YourBotName <your question>`) in any Slack channel or thread where the bot has been added.
179+
180+
> **Note:** Only users with the appropriate Cortex Agentic Assistant permissions can interact with the bot. Users without the required permissions will receive an error message prompting them to contact their administrator.
181+
182+
#### Conversation Flow
183+
184+
1. **Mention the bot** — Type `@YourBotName` followed by your question or request in a channel or thread.
185+
2. **Agent selection** — On the first interaction, the assistant presents a dropdown menu of available AI agents (e.g., Case Investigation, Threat Intel). Select the agent best suited for your query.
186+
3. **AI response** — The assistant replies in the same thread with the AI-generated response.
187+
4. **Follow-up questions** — Continue the conversation in the same thread by mentioning the bot again. The assistant maintains context from previous messages in the thread (up to the last 5 messages).
188+
189+
#### Sensitive Action Approval
190+
191+
When the AI agent needs to perform a sensitive action (e.g., blocking an IP, isolating an endpoint), it will:
192+
193+
1. Display the action details with an **⚠️ Sensitive action detected** warning.
194+
2. Present **Proceed** and **Cancel** buttons.
195+
3. Wait for the conversation owner to approve or reject the action before continuing.
196+
197+
> **Note:** Only the user who started the conversation can approve or reject sensitive actions.
198+
199+
#### Available Commands
200+
201+
| Command | Description |
202+
|---------|-------------|
203+
| `@BotName <question>` | Send a question or request to the AI assistant. |
204+
| `@BotName !help` | Display help information about the assistant, including usage tips. |
205+
| `@BotName !reset` | Reset the current session and release the thread lock, allowing a new conversation to start. |
206+
207+
#### Feedback
208+
209+
Each AI response includes feedback buttons:
210+
211+
- **Good response** 👍 — Mark the response as helpful.
212+
- **Bad response** 👎 — Opens a feedback modal where you can select specific issues (e.g., *Factually incorrect*, *Unhelpful*, *Answered another question*) and provide additional comments.
213+
214+
Feedback is sent back to the platform to help improve AI responses over time.
215+
216+
#### Thread Locking
217+
218+
- Each thread is locked to the user who started the conversation. Other users cannot interact with the assistant in the same thread.
219+
- Other users will see a message indicating the thread is locked and can start their own conversation in a different thread.
220+
- To release a locked thread, any Cortex user can type `@BotName !reset`.
221+
222+
#### Session Management
223+
224+
Conversations automatically expire after 14 days of inactivity. After this period, the thread is unlocked, and a new conversation can begin.
225+
226+
## Backward Compatibility with Slack V2
146227

147228
Slack V3 contains improvements to enhance the stability of the integration as well as the circumvention of OProxy. This
148229
version is intended to provide customers with more granular control over the Slack integration by enabling the

Packs/Slack/Integrations/SlackV3v2/SlackV3v2.yml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -573,7 +573,7 @@ script:
573573
- contextPath: Slack.Thread.ID
574574
description: The Slack thread ID.
575575
type: String
576-
dockerimage: demisto/slackv3:1.0.0.6976072
576+
dockerimage: demisto/slackv3:1.0.0.8198656
577577
longRunning: true
578578
runonce: false
579579
script: '-'

Packs/Slack/README.md

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -25,6 +25,22 @@ Send messages and notifications to your Slack team and integrate with Slack's se
2525
- Rules for parsing and modeling Slack audit logs that are ingested via the event collector into Cortex XSIAM.
2626
- The ingested Slack logs can be queried in XQL Search using the *`slack_slack_raw`* dataset.
2727

28+
</~XSIAM>
29+
30+
<~PLATFORM>
31+
32+
### Cortex Agentic Assistant in Slack
33+
34+
Interact with the **Cortex Agentic Assistant** directly from Slack. Mention the bot in any channel or thread to ask security questions, run investigations, and get AI-powered responses, all without leaving Slack.
35+
36+
![Cortex AI Assistant in Slack](doc_files/slack_ai_assistant_demo.png)
37+
38+
> For setup instructions and detailed usage, see the [Slack V3 integration README](https://xsoar.pan.dev/docs/reference/integrations/slack-v3#cortex-ai-assistant-in-slack).
39+
40+
</~PLATFORM>
41+
42+
<~XSIAM>
43+
2844
## Supported log categories
2945

3046
| Category | Category Display Name |

Packs/Slack/ReleaseNotes/3_7_0.md

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
2+
#### Integrations
3+
4+
##### Slack v3
5+
6+
- Updated the Docker image to: *demisto/slackv3:1.0.0.8198656*.
7+
8+
<~PLATFORM>
9+
10+
- Added support for interaction with Cortex Assistant in Slack channels where the bot is a member. Mention the bot to start a conversation with AI agents. This feature can be disabled using the *Enable AI Assistant* integration parameter. Available from Cortex Automation version 8.14.0.
11+
12+
</~PLATFORM>
711 KB
Loading

Packs/Slack/pack_metadata.json

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@
22
"name": "Slack",
33
"description": "Interact with Slack API - collect logs, send messages and notifications to your Slack team.",
44
"support": "xsoar",
5-
"currentVersion": "3.6.3",
5+
"currentVersion": "3.7.0",
66
"author": "Cortex XSOAR",
77
"url": "https://www.paloaltonetworks.com/cortex",
88
"email": "",

0 commit comments

Comments
 (0)