Use Torq Interact to send and create secure and interactive web pages and web forms that collect data, log answers, provide information, upload or download files, and propel workflows forward according to the responses received. Torq Interact allows multiple SOC analysts to make parallel decisions quickly, improving response times, enriching attack reports with the end-user's experience, and more. Interact can also be used within cases as tasks. Torq Interact can also be used to build a portal!
Interaction - an operator or a trigger in a workflow representing a single web page/ web form / task configuration, and the linear time (compared to other steps) will be available during the workflow execution.
Interaction Flow - a series of Interactions accessible from the same web page or cases task. Each Interaction flow represents an end-user journey of communication with Torq.
Preview the Interaction in the configuration panel.
By design, a workflow will not move on to the next steps while an Interaction is still waiting for responses and has not yet timed out. If you have steps that you would like executed while the workflow waits for responses, create a parallel execution to run them at the same time as the Interaction flow.
Interaction Basics
Drag and drop elements into the Interaction configuration area to build your ideal Interaction content. Rearrange elements by dragging them into alternative orders. Each Interaction can contain as many elements as needed.
Each element can be copied or deleted by using the icons on the right-hand side of the element. To select multiple elements at once, hold down the Shift button. From there, Cmd+C will copy, Cmd+V will paste, and Cmd+D will delete. The exception is the Headline element, which cannot be deleted or replicated. Elements can be copied and pasted across workflows and workspaces.
Each element has a unique Context reference, allowing easy access from other steps within the workflow. The default context reference is based upon the Text and will auto-change whenever the related text does. The context reference is editable as desired and cannot be empty.
Each element allows for a Description, where you can write clarifying information for the user. The description can remain empty if you wish.
Each element requires a Default value, the initial value that an input will contain, provided before the user makes any changes. If the user makes no changes, this value will be returned to Torq.
You can change the element type from the Type dropdown menu. When the type is changed, the description, text, and context reference remain the same, but any created unique values will not be saved.
Two types of elements are available within a Torq Interact form:
Control Elements
Condition creates complex logic directly within your Interaction to dynamically present display and user input elements based on live responses.
Display Elements -
Markdown allows for the presentation of text or any other markdown-generated content (images, links, etc.) to the user.
Button presents a button that will navigate the user to the next Interaction Flow in the series. Customize the text on the button as you wish. Removing the button is only possible on the final Interaction Flow of the series and will end the flow.
Add a secondary button to allow the user to move forward within the Interaction Flow even if they have not filled in all the required fields.
File Download allows you to upload a file (directly or via workflow context) for the end user to download.
Link adds links to published workflows and allows viewing users to trigger workflows with a click.
You may add an external link instead of the Interact workflow URL by pasting the desired URL into the Link to field.
You may use this element to create an interactive Portal for users.
User input elements allow the user to input data via a form. Input elements can be marked as required or unrequired.
Short text requests the user write a short answer.
Long text requests the user to write a long answer.
JSON requests that the user insert a JSON.
File requests the user upload a file or multiple files.
The size limit for a user-uploaded file in an Interaction Flow/Cases Task is 50MB.
Number requests the user return a number.
Boolean requests the user toggle a true or false button.
Single select requests the user select one option from a curated menu.
Multi-select requests the user to select multiple options from a curated menu.
Date and Time requests the user select a date and time from a calendar picker. When building the Interaction Flow, you can request the user select either a date and time or just a date.
To change the Interaction Flow settings, click on the top right corner Interaction Flow settings button on any Interaction Flow operator or from the topbar over each step. From there, you can:
Rename the Interaction Flow.
Reassign the Interaction to a different Interaction Flow.
Control the user access for the specific Interaction Flow. You can set the access to only Torq users, or users who use your organization's SSO.
To use SSO, go to your workspace settings in Torq and ensure SSO IdP is enabled and configured correctly.
Add users to the Torq group within your IdP (ex: JumpCloud, Okta, etc.) and assign roles to them within the IdP.
Do not add users directly within the Torq app.
Do not configure claim mappings in Torq for IdP roles that are assigned solely to users with Interact access.
All users added to the Torq group of your SSO application will have access to Interact forms.
These users will not have access to the Torq app, as long as no claims mapping in Torq are defined for their roles.
You can change the logo on the web page by going to Settings > General in your workspace.
Display Only Interaction
To send an Interaction that will not request user submission, use the Markdown element alone, without any input or button elements. Inside an Interaction Flow, only the final Interaction can be display only.
See our guide to building a display-only portal using Torq Interact!
Starting a Workflow with the Interact Trigger
Create a new workflow and select the Torq Interact Trigger.
Once the workflow is created, open the Interact trigger and drag and drop your desired elements.
Add another Interaction to the Interaction Flow from the operators’ menu and select to assign it to the existing interaction flow. The new Interaction will follow the previous trigger on the webpage or task created. You can also add a new Interaction to the specific Interaction Flow with the button that appears upon clicking the step or the trigger.
When starting an Interaction with a trigger, you can view the email of the user who submitted the Interact form by accessing {{ $.metadata.user_email }} within the workflow.
Starting an Interaction Flow Inside a Workflow
A new Interaction Flow can start at any point within a workflow. When an Interaction Flow does not originate from a trigger, you can select whether the Flow will display as a webpage or a Cases Task.
Drag the Interaction operator from the operator’s panel to the proper location on the canvas.
Give the Interaction Flow a relevant name.
In Interaction Flow settings, select if this Interaction Flow is a case task or a web page and change the access as needed.
Click Save to retain changes.
Every Interaction Flow that begins in the middle of a workflow and is not meant for a case has a URL that can be sent to the end user by a chatbot or email.
Changing the Interaction’s Assignment to a Different Interaction Flow
Switch which Interaction Flow an Interaction belongs to by clicking on the operator in the workflow and then Interaction Flow > Change. From there, you can select either New Interaction Flow to create a new flow that begins with that Interaction or Existing Interaction Flow to add that Interaction to an already existing Interaction Flow within the workflow. This can also be done from within the Interaction Flow's settings.
Link to the Interaction Flow
To access an Interaction Flow's URL within another step, type $ to access autocomplete > interaction_flows_url and select the relevant Interaction Flow. ex: {{ $.interaction_flows_url.'My Interaction Flow' }}
Parallel Interaction Flows
Two Interactions from the same Interaction Flow cannot be run in parallel.
A parallel loop generates a dedicated Interaction Flow URL for each loop iteration. Since an Interaction Flow executed in a parallel loop creates multiple URLs for the same Interactions, which will be sent to multiple users or cases, all Interactions related to the Interaction Flow must be contained within the loop.