Slack chatbot

This tutorial demonstrates several useful Slack use cases to help you get started and give you ideas for how you can use Slack in your Torq workflows.

Go here to learn how to set up the available Slack integrations. Continue reading to get an idea of what you can do with them.

The following Slack chatbot use cases are covered in this tutorial:

• Trigger a Torq workflow by running a command in Slack
• Send a Slack message
• Send a Slack question (Basic)
• Send a Slack question (Advanced)
• Monitor a Slack channel and act based on the message content

The tutorial is based on an example workflow that is triggered when a user runs a command in Slack to investigate a URL (or a list of URLs). The workflow loops over the URLs provided by the user, scans each URL with VirusTotal after getting the user confirmation, attempts to retrieve the analysis results, and offers to continue the investigation when relevant.

Trigger a Torq workflow by running a command in Slack

You can trigger Torq workflows without leaving Slack. Follow these instructions to set up a Slack Slash Commands integration and create a new Slack slash command: check-url.

After you create the check_url Slack slash command you can use it to trigger a Torq workflow from Slack.

Run the slash command in the channel you want to get the investigation results in.

The Slack slash commands integration you created can be used as a trigger in a Torq workflow.

You can add a condition to the trigger. The workflow should only be triggered if the check_url command was used. By adding the condition, you're ensuring nothing else will trigger this workflow. You can add as many unique commands as you would like to trigger different workflows.

A new trigger event is created when you run the slash command in Slack. You can view the event JSON to see what information you now have at your disposal to use for the URL investigation. 

Extract the URLs from the command by using $.event.text

The next section includes another example of how you can further use the information. 

Send a Slack message

You can use the Send Message step in your Torq workflow to send either a direct message to a user or a general message to a Slack channel. 

Follow these instructions to set up a Slack step integration. 

The example below shows how you can use information from the trigger event JSON to send a confirmation message. 

Use $.event.channel_id with the hashtag symbol (#) as a prefix in the RECIPIENT field to send the message in the channel the slash command was used to trigger the workflow.

Use  {{ $.event.user_name }}  to mention the user who triggered the workflow.  

You can also use  $.event.user_id  as input for the Get User Details by ID step to get the email of the user who triggered the workflow. This email can then be used in the RECIPIENT field of a Send Message step to send a direct message. 

Click the cogwheel icon to see a complete list of optional parameters for the Send Message step. 

Send a Slack question (Basic)

You can use the Ask a Question step in your Torq workflow to send a Slack message that contains a question and saves the user's response. The user response can then be used to direct your workflow. 

Let's return to the example workflow. You can loop over the URLs extracted from the user Slack command and confirm whether a ViriusTotal scan is required for each one.

The question can be sent to the Slack channel the workflow was originally triggered from, or directly to a user. 

You need to provide the responses the user can choose from, and select if they will be presented as buttons or single or multi-select. There are also a few more optional parameters for you to utilize if you choose. 

The question is then sent to the user in the specified Slack channel. 

The user response can be referenced by using $.ask_a_question.slack_response. If the user responds with Yes, the URL is scanned with VirusTotal. 

Send a Slack question (Advanced)

Retrieving the ViriusTotal results may take time, so if the scan isn't complete upon the first check, you may want to offer the user the option to wait an additional period for the scan results. You can add another Ask a Question step to notify the user that the scan didn't finish, and ask them if they would like to keep waiting. 

The possible responses are Yes and No. If the user responds No, no additional information is required and the workflow can continue. If the user responds Yes, you can ask the user how long they want to wait. This can be done by setting the optional RESPONSES_REQUIRING_NOTE parameter - in this example, the response that requires a note is Yes. In addition, the optional THREAD_TS parameter is used and the input $.ask_a_question.ts which ensures the question will continue the original URL scan thread. 

The user is asked to specify the waiting period in seconds. 

The user response to the note is used in the workflow as the duration for a Wait operator: $.ask_a_question.note_response.

Monitor a Slack channel and act based on message content

You can use the Custom Slack Events integration to trigger Torq workflows for different events in Slack. For example, you can monitor a Slack channel and perform actions in Torq according to the content of the messages sent in it. 

Follow these instructions to set up a Custom Slack Events integration. Subscribe to the messages.channels event. 

Let's return to the example workflow. If the VirusTotal scan returns no data or the URL is found to be harmless, the user is prompted with a message suggesting to further investigate the URL using a different vendor by replying with a message that has this format: Check URL <URL> with <vendor>. 

The user can reply in the thread or send a message to the channel. 

Since you're subscribed to the channel.message event, sending the message is a triggering event. 

You can create an additional workflow that uses the custom Slack Events integration as a trigger. This workflow monitors the #security Slack channel and catches messages that contain the "check URL" string. 

Next, the vendor name is extracted from the Slack message. The URL is checked by the additional vendor and the information is returned to the same Slack channel. This concludes the URL investigation.