You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: Packs/Slack/Integrations/SlackV3v2/README.md
+82-1Lines changed: 82 additions & 1 deletion
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -142,7 +142,88 @@ messages and the steady flow of the integration.**
142
142
2. Navigate to your Instance Settings page in Cortex XSOAR and click **Test**. A message should appear in the channel
143
143
from your app.
144
144
145
-
## Backwards Compatibility with Slack V2
145
+
## Cortex Agentic Assistant in Slack
146
+
147
+
The Slack integration allows users to interact with the **Cortex Agentic Assistant** directly from Slack. Users can mention the bot in any channel or thread to ask security questions, run investigations, and receive AI-powered responses, all without leaving Slack.
148
+
149
+

150
+
151
+
### Prerequisites
152
+
153
+
Before you begin, ensure the following requirements are met:
154
+
155
+
1.**Supported Cortex product version** — The tenant must be running one of the following versions (or later), depending on your product:
156
+
157
+
| Product | Minimum Version |
158
+
|---------|-----------------|
159
+
| Cortex AGENTIX | V1.3 |
160
+
| Cortex Platform | 1.5 |
161
+
| Cortex CLOUD | 2.1 |
162
+
| Cortex XDR | 3.18 / 5.1 |
163
+
| Cortex XSIAM | 2.10 / 3.5 |
164
+
165
+
2.**Slack App installed** — The Slack app must be created and installed in your workspace as described in [Creating a Custom App](#creating-a-custom-app) and [Installing the App to Your Workspace](#installing-the-app-to-your-workspace).
166
+
3.**Slack content pack version 3.6.0 or later** — This includes the SlackV3 integration.
167
+
4.**User permissions** — Each Slack user who interacts with the Cortex Agentic Assistant must have the appropriate permissions to use the Cortex Agentic Assistant in the Cortex platform. Users without the required permissions will receive an error message when attempting to interact with the bot. Contact your Cortex administrator to ensure the relevant roles and permissions are assigned.
168
+
169
+
### How to Enable
170
+
171
+
To enable this feature, configure the following in the integration instance settings.
172
+
173
+
1. Check **Enabled AI assistant**.
174
+
2.**Long running instance** — The **Long running instance** checkbox must be enabled in the instance settings (required for listening to bot mentions in real time).
175
+
176
+
### How It Works
177
+
178
+
Once the prerequisites are met, users can interact with the Cortex Agentic Assistant by mentioning the bot (for example, `@YourBotName <your question>`) in any Slack channel or thread where the bot has been added.
179
+
180
+
> **Note:** Only users with the appropriate Cortex Agentic Assistant permissions can interact with the bot. Users without the required permissions will receive an error message prompting them to contact their administrator.
181
+
182
+
#### Conversation Flow
183
+
184
+
1.**Mention the bot** — Type `@YourBotName` followed by your question or request in a channel or thread.
185
+
2.**Agent selection** — On the first interaction, the assistant presents a dropdown menu of available AI agents (e.g., Case Investigation, Threat Intel). Select the agent best suited for your query.
186
+
3.**AI response** — The assistant replies in the same thread with the AI-generated response.
187
+
4.**Follow-up questions** — Continue the conversation in the same thread by mentioning the bot again. The assistant maintains context from previous messages in the thread (up to the last 5 messages).
188
+
189
+
#### Sensitive Action Approval
190
+
191
+
When the AI agent needs to perform a sensitive action (e.g., blocking an IP, isolating an endpoint), it will:
192
+
193
+
1. Display the action details with an **⚠️ Sensitive action detected** warning.
194
+
2. Present **Proceed** and **Cancel** buttons.
195
+
3. Wait for the conversation owner to approve or reject the action before continuing.
196
+
197
+
> **Note:** Only the user who started the conversation can approve or reject sensitive actions.
198
+
199
+
#### Available Commands
200
+
201
+
| Command | Description |
202
+
|---------|-------------|
203
+
|`@BotName <question>`| Send a question or request to the AI assistant. |
204
+
|`@BotName !help`| Display help information about the assistant, including usage tips. |
205
+
|`@BotName !reset`| Reset the current session and release the thread lock, allowing a new conversation to start. |
206
+
207
+
#### Feedback
208
+
209
+
Each AI response includes feedback buttons:
210
+
211
+
-**Good response** 👍 — Mark the response as helpful.
212
+
-**Bad response** 👎 — Opens a feedback modal where you can select specific issues (e.g., *Factually incorrect*, *Unhelpful*, *Answered another question*) and provide additional comments.
213
+
214
+
Feedback is sent back to the platform to help improve AI responses over time.
215
+
216
+
#### Thread Locking
217
+
218
+
- Each thread is locked to the user who started the conversation. Other users cannot interact with the assistant in the same thread.
219
+
- Other users will see a message indicating the thread is locked and can start their own conversation in a different thread.
220
+
- To release a locked thread, any Cortex user can type `@BotName !reset`.
221
+
222
+
#### Session Management
223
+
224
+
Conversations automatically expire after 14 days of inactivity. After this period, the thread is unlocked, and a new conversation can begin.
225
+
226
+
## Backward Compatibility with Slack V2
146
227
147
228
Slack V3 contains improvements to enhance the stability of the integration as well as the circumvention of OProxy. This
148
229
version is intended to provide customers with more granular control over the Slack integration by enabling the
Copy file name to clipboardExpand all lines: Packs/Slack/README.md
+16Lines changed: 16 additions & 0 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -25,6 +25,22 @@ Send messages and notifications to your Slack team and integrate with Slack's se
25
25
- Rules for parsing and modeling Slack audit logs that are ingested via the event collector into Cortex XSIAM.
26
26
- The ingested Slack logs can be queried in XQL Search using the *`slack_slack_raw`* dataset.
27
27
28
+
</~XSIAM>
29
+
30
+
<~PLATFORM>
31
+
32
+
### Cortex Agentic Assistant in Slack
33
+
34
+
Interact with the **Cortex Agentic Assistant** directly from Slack. Mention the bot in any channel or thread to ask security questions, run investigations, and get AI-powered responses, all without leaving Slack.
35
+
36
+

37
+
38
+
> For setup instructions and detailed usage, see the [Slack V3 integration README](https://xsoar.pan.dev/docs/reference/integrations/slack-v3#cortex-ai-assistant-in-slack).
- Updated the Docker image to: *demisto/slackv3:1.0.0.8198656*.
7
+
8
+
<~PLATFORM>
9
+
10
+
- Added support for interaction with Cortex Assistant in Slack channels where the bot is a member. Mention the bot to start a conversation with AI agents. This feature can be disabled using the *Enable AI Assistant* integration parameter. Available from Cortex Automation version 8.14.0.
0 commit comments