enhancement(events): prompt assignee for triage in Slack #6032
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
aaronherman
commented
Jun 3, 2025
There was a problem hiding this comment.
Pull Request Overview
This PR adds a reminder prompt for case assignees to complete security event triage in Slack, incorporates a new “visibility” field into case update modals, and wires up an escalate-case slash command.
- Map
escalate_casecommand to Slack slash commands - Introduce
case_visibility_selectfield and handle it in the update modal/submission - Add
send_event_update_prompt_reminderand invoke it in the new case flow
Reviewed Changes
Copilot reviewed 7 out of 7 changed files in this pull request and generated 4 comments.
Show a summary per file
| File | Description |
|---|---|
| src/dispatch/plugins/dispatch_slack/plugin.py | Register escalate_case in Slack command mappings |
| src/dispatch/plugins/dispatch_slack/fields.py | Define case_visibility_select enum and builder function |
| src/dispatch/plugins/dispatch_slack/case/interactive.py | Add “Update Case” button handler, inject visibility into modal, and process it on submit |
| src/dispatch/plugins/dispatch_slack/case/enums.py | Add new CaseNotificationActions.update |
| src/dispatch/conversation/enums.py | Add new ConversationCommands.escalate_case |
| src/dispatch/case/messaging.py | Implement send_event_update_prompt_reminder |
| src/dispatch/case/flows.py | Invoke the new reminder step in case_new_create_flow |
Comments suppressed due to low confidence (1)
src/dispatch/case/messaging.py:381
- Consider adding unit tests or an integration test for
send_event_update_prompt_reminderto ensure ephemeral messages are sent under expected conditions.
def send_event_update_prompt_reminder(case: Case, db_session: Session) -> None:
Co-authored-by: Copilot <[email protected]> Signed-off-by: Aaron Herman <[email protected]>
…ispatch into feat/prompt-for-triage
Co-authored-by: Copilot <[email protected]> Signed-off-by: Aaron Herman <[email protected]>
…ispatch into feat/prompt-for-triage
whitdog47
reviewed
Jun 3, 2025
whitdog47
approved these changes
Jun 4, 2025
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This pull request includes adding functionality to prompt assignees to update security events and adds a "visibility" field for case updates in Slack.
Workflow Enhancements:
send_event_update_prompt_remindertocase_new_create_flowinsrc/dispatch/case/flows.pyand insrc/dispatch/case/messaging.pyto remind assignees to update security event details during triage, which sends an ephemeral Slack message to the assignee with a button to update case details.Slack Integration Updates:
escalate_casecommand toConversationCommandsinsrc/dispatch/conversation/enums.pyand mapped it to Slack configurations. [1] [2]update_case_button_clickhandler insrc/dispatch/plugins/dispatch_slack/case/interactive.pyto process the "Update Case" button click and open the update modal.Case Visibility Field:
case_visibility_selectfunctionality insrc/dispatch/plugins/dispatch_slack/fields.pyto allow users to choose "Restricted" or "Open" visibility for cases.handle_edit_submission_eventinsrc/dispatch/plugins/dispatch_slack/case/interactive.pyto process the visibility field and save changes.