User communication

Manage user communications after deploying Cortex XSOAR 8.10 On-prem.

In Cortex XSOAR, you can configure mail and messaging integrations to send notifications to users and you can customize the subject and body of system emails.

Users can choose which notifications to receive and whether to receive notifications via email, Slack, Microsoft Teams, or other communication tools. For more information, see User details and preferences.

Configure user notifications in Cortex XSOAR

Cortex XSOAR can send out notifications and emails to users through the following:

• By email using a mail sender
• By a message notification such as Slack.

Mail Sender integrations

A mail integration enables Cortex XSOAR to send emails and can be used for system notifications and playbooks. For example, when adding users to Cortex XSOAR, an email invitation is sent to users to log in. When you use the mail integration for playbook tasks, you can pass arguments such as to, subject, body, etc. to customize the contents of your email.

1. Go to Marketplace.
2. Search for and download a mail sender content pack (such as Microsoft Exchange On-Premise).
3. Go to Settings & Info → Integrations → Instances.
4. Locate the mail sender integration (for example, EWS v2) and click Add Instance.
5. Configure your mail sender integration and select Enable to enable your mail sender integration.
6. If you configure multiple email integrations, select the Do not use in CLI by default option in the integration instances that should not be used to send emails. This ensures that the email will only be sent in the instance you are expecting when running the send-mail command from the CLI or within a playbook.

Multiple sender integrations

When there are multiple instances of a mail sender in Cortex XSOAR, you can choose which email sender should send the notification by configuring the server.notification.using.sendmail key in the advanced server configuration settings.

If you do not configure the advanced server setting, Cortex XSOAR uses the first email integration it finds to send the system notifications.

1. Navigate to Settings & Info → Settings → Server Settings → Server Configuration → Add Server Configuration.
2. Add the following key and enter the mail sender instance name:

   Key	Value
   server.notification.using.send-mail	The mail sender instance name.

Configure a messaging integration

If your organization uses a messaging service, such as Slack or Microsoft Teams, we recommend installing the relevant content pack.

The Slack content pack enables you to send messages and notifications to your Slack team and integrates with Slack's services to execute create, read, update, and delete operations for employee lifecycle processes. For more information, see Slack content pack. For more information about Microsoft Teams, see Microsoft Teams content pack.

Customize system emails

Cortex XSOAR sends notifications to users. You can customize the subject and the contents of the email, and choose whether to send the email in HTML format. The following are the default message subjects and the default message contents:

Message Type	Default Subject	Default Message Body
mentionNew	Message from Cortex XSOAR Security Operations Server	{{.username}} added you to investigation {{.invName}}.\nYou were mentioned: {{.parentContent}}.
mentionNewNoContent	Message from Cortex XSOAR Security Operations Server	{{ .username}} added you to investigation {{ .invName}}.
mentionOld	Message from Cortex XSOAR Security Operations Server	{{ .username}} mentioned you in investigation {{ .invName}}: {{ .parentContent}}.
assign	Message from Cortex XSOAR Security Operations Server	{{ .username}} assigned task #{{ .taskId}} in investigation {{ .invName}} to you. Note The assign message type is only relevant for Playbook tasks.
todoAssign	Message from Cortex XSOAR Security Operations Server	{{.username}} assigned To-Do task {{.title}} in investigation {{.invName}} to you.
taskCompleted	Message from Cortex XSOAR Security Operations Server	{{ .username}} completed task #{{ .taskId}} in investigation {{.invName }}.
taskUpdated	Message from Cortex XSOAR Security Operations Server	{{.username}} updated task #{{.taskId}} in investigation {{.invName}}.
investigationClosed	Message from Cortex XSOAR Security Operations Server	{{.username}} has closed investigation {{.invName}}.
investigationWaiting	Message from Cortex XSOAR Security Operations Server	{{.username}}, {{.invName}} has stopped and is waiting your instructions."
investigationError	Message from Cortex XSOAR Security Operations Server	{{.username}}, {{.invName}} has stopped because of an error.
investigationDeleted	Message from Cortex XSOAR Security Operations Server	{{.username}} has deleted investigation {{.invName}}.
incidentOpened	Message from Cortex XSOAR Security Operations Server	{{.username}} has reported {{.incTermArticle}} {{.incTermSingular}} {{.invName}}.
incidentChanged	Message from Cortex XSOAR Security Operations Server	{{.username}} has updated {{.incTermArticle}} {{.incTermSingular}} {{.invName}}.
incidentStatusChanged	Playbook has stopped on {{ .runStatus}} for {{ .invName}} (#{{ .incID}})	{{.incTermCapitalSingular}} playbook task "{{.taskName}}" stopped on {{.runStatus}}. {{.incTermCapitalSingular}} Id: #{{.incID}}{{.incTermCapitalSingular}} Name: {{.invName}}{{.incTermCapitalSingular}} SLA: {{.SLA}}{{.incTermCapitalSingular}} Severity: {{.severity}}Task: #{{.taskID}}Task Name: {{.taskName}}Task SLA: {{.TaskSLA}}
incidentAssigned	Message from Cortex XSOAR Security Operations Server	{{.username}} has assigned you {{.incTermArticle}} {{.incTermSingular}} {{.invName}}.
taskCompletedWithNotes	Message from Cortex XSOAR Security Operations Server	{{.username}} completed task #{{.taskId}} in investigation {{.invName}}.\nCompletion note was: {{.taskComment}}
incidentReminderSLA	Message from Cortex XSOAR Security Operations Server	FYI, {{.incTermSingular}} #{{.invID}} "{{.reminedOn}}" - SLA expiration is approaching. ({{.SLA}})
MessageTypeTaskSLA	Message from Cortex XSOAR Security Operations Server	FYI, task "{{.reminedOn}}" (from investigation {{.invName}}) - due date is approaching. ({{.SLA}})
newContentAvailable	Message from Cortex XSOAR Security Operations Server	A content update: {{.release}} for your Demisto Server is available.\n{{.releaseNotes}}
failedFetchIncidents	Integration instance {{ .instance}} ({{ .brand}}) failed fetching new {{ .incTermPlural}}	Integration instance {{.instance}} ({{.brand}}) failed fetching new {{.incTermPlural}} at {{.date}}\nerror message is:\n{{.error}}
engineDisconnected	Cortex XSOAR Engine Disconnected	Engine '{{.name}}' ({{.host}}) is disconnected. Engines will not process integration automations until it is reconnected.
externalFormSubmit	{{ .subject}}	""
externalAskSubmit	{{ .subject}}	""
jobRunning	Message from Cortex XSOAR Security Operations Server	A previous instance of job {{.invName}} is already running.

Change the email subject

You can customize the subjects of system emails.

1. Go to Settings & Info → Settings → System → Server Settings → Server Configuration.
2. Add the key messages.subject.formats.<MessageType>, where <MessageType> is the type of message, such as assign or taskCompleted. For the value, enter your custom subject. You can use any of the default variables, for example .invName in your subject.

   Examples:

   Key	Value
   messages.subject.formats.assign	You were assigned to an incident
   messages.subject.formats.taskcompleted	Task completed in {{.invName }}

Change the email body

You can customize the content of the system messages, and include variables such as .username and .invName in your body content.

You can send HTML or non HTML messages. If you have users who can only receive plain text, use the key messages.formats.<MessageType>, where <MessageType> is the type of message, such as assign or taskCompleted. Enter your custom body text as the value. If you have users who can receive HTML emails, use the key messages.HTML.formats.<MessageType>, where <MessageType> is the type of message. Enter your custom body text as the value. To set custom body text for both text and HTML messages, add both keys/values for each message you want to customize.

1. Go to Settings & Info → Settings → System → Server Settings → Server Configuration.
2. Add the key messages.formats.<MessageType> or messages.HTML.formats.<MessageType>. For the value, enter your custom email body.

   Examples:

   Key	Value
   messages.HTML.formats.assign	{{.username}} added you to investigation {{.invName}}.\nPlease log in and review.
   messages.formats.assign	{{.username}} added you to investigation {{.invName}}.\nPlease log in and review.