Slack - Send Message for New Incident

This workflow works with an incident automation rule to send a Slack message when a new incident is created in Cisco XDR. You can limit which incidents Slack messages are sent for by adding criteria to the automation rule. If you want to send messages to different channels for different types of incidents, you can duplicate the workflow and configure multiple different automation rules.

Note: After importing the workflow, be sure to create an incident automation rule or add the workflow to an existing rule.

Target: Slack

Steps:

• Extract the short incident ID
• Build the Slack message payload
• Send the Slack message
• Check if sending the message was successful:
  • If it was, set the workflow result
  • If it wasn't, output an error