})
1. Ensure that the **Add one or more params as a playbook input** field is left blank: })
})
})
### Manually add a playbook to an incident
1. Open the [incident](/docs/cloud-soar/incidents-triage/#incidents) in Cloud SOAR.
1. Select **Operations > Playbooks**.
1. Click the **+** button to add the playbook.
1. Click **List View** to see the playbooks attached to the incident.})
### Monitor and run playbooks on incidents
To monitor and run playbooks on [incidents](/docs/cloud-soar/incidents-triage/#incidents):
1. Within an incident, select **Operations > Playbooks** to see the playbooks assigned to the incident.
1. If playbooks have not been assigned by an incident template, you can add playbooks by clicking the **+** button.
1. To manually run a playbook for the incident, click the **Run** button at the bottom of the screen.})
### Add a playbook to an incident with the API
You can attach playbooks to an [incident](/docs/cloud-soar/incidents-triage/#incidents) with the API. This lets you automate incident workflows without having to use the UI, and enables integration with external systems.
Use the following APIs:
* [incidents_runbook_create](https://api.sumologic.com/docs/csoar/#operation/incidents_runbook_create). Attach one or more playbooks to an incident, with an option to auto-run them after attachment.
* [incidents_runbook_retrieve](https://api.sumologic.com/docs/csoar/#operation/incidents_runbook_retrieve). Retrieve all playbooks attached to a specific incident.
* [playbook_list_retrieve](https://api.sumologic.com/docs/csoar/#operation/playbook_list_retrieve). Get a list of all playbooks, including their IDs. Use the playbook IDs to run the above incident APIs.
For more information about how to use APIs, see [Cloud SOAR APIs](/docs/api/cloud-soar/).
## Incident templates
Incident templates define the way in which incidents will be created for a specific alert, incident type, or event. They allow you to define a certain number of incident attributes (for example, incident type, severity, assignment, and any other default or custom incident parameters) that will automatically be set each time an incident is generated, based on the template. This may include type, classification, incident assignment, playbooks, knowledge base articles, or any other incident attribute. Since rules are created for generating incidents based on syslog messages, email, SIEM integrations, or other data sources, it is the incident templates that will define how the initial incident will be created.
### Create a new incident template
1. [**New UI**](/docs/get-started/sumo-logic-ui/). In the main Sumo Logic menu select **Automation > Template**. You can also click the **Go To...** menu at the top of the screen and select **Template**. })
1. Define the template: })
1. **Template name**. Enter a name that is easily identifiable and related to the activity it is developed for.
1. **Category**. Enter a category for this template. For example, suppose we're building a template for a Data Loss Prevention (DLP) incident. We might enter a category named **Data Theft**, but we can enter anything we want that will help us group incident templates in the future. You can customize this field to fit your environment, as well as all other fields in Cloud SOAR (see [Custom fields](/docs/cloud-soar/settings/#custom-fields)).
1. **Tags**. Enter any tags to further categorize or define the incident. You can use these tags later when searching for or correlating events.
1. Click **Incident** at the top of the dialog.
1. Define any incident parameters you want to set by default when an incident is creating using the template: })
1. Click **Apply**. The new template is displayed. })
1. Scroll down and enter the following:
1. **Incident details**. Click the **Edit** toggle to set up details for a specific incident type.
1. **Description**. Describe details of the template.
1. **Playbook**. Select the playbooks that should be automatically assigned to an incident. For each playbook, you can choose to have the playbook automatically execute immediately upon incident creation, or assigned and wait for manual execution.
1. **Investigators**. Select the investigators who should be automatically assigned to the incident.
1. **Notes**. Enter notes which should be created for the incident.
1. **Mapping**. Select the daemon field mapping for the template.
### Configure a webhook for Cloud SOAR
You can configure a [webhook connection](/docs/alerts/webhook-connections/cloud-soar/) to allow you to send an alert from a scheduled search to Sumo Logic Cloud SOAR using an incident template.
1. [**New UI**](/docs/get-started/sumo-logic-ui). In the main Sumo Logic menu select **Monitoring > Connections**. You can also click the **Go To...** menu at the top of the screen and select **Connections**. })
1. Enter a **Name** and give an optional **Description** to the connection.
1. The **URL** field shows your [Sumo Logic API endpoint](/docs/api/about-apis/getting-started#sumo-logic-endpoints-by-deployment-and-firewall-security) followed by `/csoar/v3/incidents/`. For example, `https://api.us2.sumologic.com/api/csoar/v3/incidents/`
1. In **Authorization Header**, enter your basic authentication access information for the header. For example, `Basic [**Classic UI**](/docs/get-started/sumo-logic-ui-classic/). Click the gear icon
}){kind=icon}
in the top right, select **Automation**, and then select **Rules** in the left nav bar. 1. Click **+** to the left of **Rules**. 1. Select a name for the rule, then select the daemon to use with this new rule, the resource, and fill in all the remaining parameters.
})
1. Click **Save**. The new rule is displayed. })
1. Add a **Filter** if desired.
1. Click **+** to the left of **Actions**.
1. Click **Action type**. })
1. Select the action Cloud SOAR will can take when the specified activity is observed:
* **Create incident from template**. Specify what [incident template](#incident-templates) to use, the incident owner, and incident ID format. This is the most common action.
* **Update incident**. Update a field in an existing incident based on parameters from the parsed message.
* **Close incident**. Automatically close a known false positive incident.
* **Add events to an existing incident**. Add events based on parameters from the parsed message.
* **Set task progress**. Set task progress based on parameters from the parsed message.
* **Close task**. Close a task based on parameters from the parsed message.
* **Add to Triage**. Create a new triage event based on parameters from the parsed message.
1. Fill out the rest of the fields for the action.
1. Click **+** to the left of **Mapping** and select the daemon field mapping for the rule.
## Configure Slack for Cloud SOAR
With the Cloud SOAR Slack integration, teams can remain connected, organize conversations, and quickly find what is needed to get the work done.
With the Cloud SOAR Slack integration, you can directly manage [user choice](/docs/platform-services/automation-service/playbooks/create-playbooks/#add-a-user-choice-node-to-a-playbook) actions within the playbooks from your Slack workspace. Furthermore, for each new incident, a related conversation channel will be created within your Slack workspace, where users will correspond to investigators. Changing a user within the incident will also result in a change to the user within the conversation channel.
:::note
To configure Slack for use inside Cloud SOAR, you must first create a public or private channel so you can send messages or files to channels or users directly.
:::
### Step 1: Create a Slack app
Before you can use the Slack integration in Cloud SOAR, you need to create a Slack app on the user or company workspace.
1. Navigate to the [Slack API page](https://api.slack.com/apps).
1. Click **Create an App**.})
1. Select **From scratch**.})
1. Enter "CSOAR Bot" as the app name and select the workspace where you wish to install it.})
1. Click **Create App**.
### Step 2: Add permissions to the Slack app
After you create a Slack app, you must add the appropriate permissions for use with Cloud SOAR.
1. Click **Permissions**, or from the left nav bar, click **OAuth & Permissions**.})
1. Scroll down to the **Scopes** section.You must add permissions for the Bot Token. Bot tokens let your app act independently. 1. Click **Add an OAuth Scope** under **Bot Token Scopes**.
})
1. Enter the following permissions.
* **Actions: List Channels / Get Channel / Get Members**
* `channels:read`. View basic information about public channels in a workspace.
* `groups:read`. View basic information about private channels that your Slack app has been added to.
* `im:read`. View basic information about direct messages that your Slack app has been added to.
* `mpim:read`. View basic information about group direct messages that your Slack app has been added to.
* **Actions: Create channel / Invite To Channel / Remove User From Channel / Archive Channel**
* `channels:manage`. Manage public channels that your Slack app has been added to and create new ones.
* `channels:write.invites`. Invite members to public channels.
* `groups:write`. Manage private channels that your Slack app has been added to and create new ones.
* `groups:write.invites`. Invite members to private channels.
* `im:write`. Start direct messages with people.
* `mpim:write`. Start group direct messages with people.
* `mpim:write.invites`. Invite members to group direct messages.
* **Actions: List Users / Get User**
* `users:read`. View people in a workspace.
* `users:read.email`. View email addresses of people in a workspace.
* **Actions: List Conversations History**
* `channels:history`. View messages and other content in public channels that your Slack app has been added to.
* `groups:history`. View messages and other content in private channels that your Slack app has been added to.
* `im:history`. View messages and other content in direct messages that your Slack app has been added to.
* `mpim:history`. View messages and other content in group direct messages that your Slack app has been added to.
* **Actions: Send Message / Delete Message**
* `chat:write`. Post messages in approved channels and conversations.
1. Verify that scopes are set up correctly:
* Here are the Bot Token scopes after configuration:})
1. Place your instance URL in the **Interactivity & Shortcuts** page. })
1. Click **Install to Workspace** to make the app available for use.})
1. Installation generates a Bot User OAuth Token and a Signing Secret. Copy the tokens and keep them in a secure location for use in the next step. })
})
### Step 3: Configure the Slack integration in Cloud SOAR
Now you must configure the Slack integration in Cloud SOAR to use the Bot OAuth Token and Signing Secret you saved in the previous step. These tokens will give the Slack integration the permissions it needs to perform the tasks in the scopes you set up.
1. Add resources for the tokens:
1. [**New UI**](/docs/get-started/sumo-logic-ui/). In the main Sumo Logic menu select **Automation > Integrations**. You can also click the **Go To...** menu at the top of the screen and select **Integrations**.[**Classic UI**](/docs/get-started/sumo-logic-ui-classic/). Click the gear icon
in the top right, select **Automation**, and then select **Integrations** in the left nav bar.
1. Select the Slack integration. The integration's resources appear.})
1. Click **+** to add a new Resource.})
1. Name the resource "Bot User OAuth Access Token".
1. Copy the Bot Oauth Token you saved from the Slack API setup and paste it Into the **Bot/User OAuth Token** field.
1. Click **TEST** to verify configuration.
1. Once you have filled in all the required fields, click **SAVE**.})
1. Configure instant messaging:
1. [**New UI**](/docs/get-started/sumo-logic-ui/). In the main Sumo Logic menu select **Cloud SOAR**, and then under **Cloud SOAR Settings** select **General**. You can also click the **Go To...** menu at the top of the screen and select **General**. [**Classic UI**](/docs/get-started/sumo-logic-ui-classic/). Click the gear icon
in the top right and select **Settings**.
1. Scroll down and open **Instant Messaging**.})
1. For **Integration** select Slack.
1. Paste your previously saved Bot User OAuth Access Token to the **Bot OAuth** field.
1. Paste your previously saved Signing Secret to the **Signing Secret for verify requests** field. If configuration is successful, **Workspace** displays "Success".
If your new resources are configured correctly, and Instant Messaging displays a "Success" message for the configured workspace, you can [Use the Slack app in User Choice](#use-the-slack-app-in-user-choice).
### Use the Slack app in User Choice
If you have configured Slack as described in [Configure Slack for Cloud SOAR](#configure-slack-for-cloud-soar), you can set a playbookâs [user choice](/docs/platform-services/automation-service/playbooks/create-playbooks/#add-a-user-choice-node-to-a-playbook) to be answered by Slack.
1. Run a playbook with a User Choice action. The following example shows a simple playbook with two available answers: **Close Incident** and **Investigate**. Notice that the option **Answer By Slack** is enabled.})
In this case, the Authorizer set is a user. If a group is chosen, a message will be sent directly from the CSOAR Bot to every available user. If a user is not selected, and the playbook is inside an incident, the message will be sent within the relevant channel in the Slack workspace, and all the users within it will be authorized to choose one of the User Choice available options. 1. When the playbook flow reaches the **User Choice**, the user will receive a message containing the reference to the incident, the playbook name, and the question set for the **User Choice**.
})
1. After a recipient chooses one of the available options, the playbook flow will continue and a message will inform the user or the group about the choice made.})
### Bidirectional use cases between Slack and incident management
You can manage Slack communication channels directly by creating or editing various incidents within Cloud SOAR. Here are some use cases:
* Creating an incident When an incident is created, a conversation channel will automatically be created within your Slack workspace, where the channel name will be formed like this: **incident-incident_id**. Furthermore, all users (owners, investigators, groups) who are part of the workspace will be added to the channel.
})
})
* Adding / removing users from the incident When users (owners, investigators, groups) are added or removed from the incident, they will be managed in the same way within the channel in the workspace. * Close / delete an incident
When an incident is closed / deleted, the related channel in the workspace will automatically be archived as well.
})
* Viewing channel history from the **War room** section Within the war room section of an incident, it will be possible to view the history of a Slack channel.
})