Slack Integration

Slack Integration

Use Slack to deliver alerting, analysis, and discovery notifications directly to your team’s channels.

Setup

1. In the app, go to Integrations and choose Slack.
2. Add your Slack bot token (starts with xoxb-) and optionally a signing secret.
3. Click Save connection.
4. Add one or more channels using their channel ID (and an optional label).
5. Configure event filters for each channel and enable delivery.

Tip

The signing secret is only needed for verifying interactive actions and events. If you only need message delivery, the bot token is sufficient.

Event types

Slack notifications are sent for these event types:

• lookup_result.alerts - Alerts that match your filters.
• lookup_result.analysis - Analysis updates that exceed your phishing score threshold.
• lookup_result.domain_discovery - Newly discovered domains within your Levenshtein distance threshold.

Event filters

Each channel has its own filters:

• Alerts
  • Minimum severity: critical, high, medium, low, informational.
  • Status filter: stable, test, experimental, deprecated, unsupported.
• Analysis
  • Phishing score threshold (0.0 - 1.0).
  • Optional “only on change” toggle to skip duplicate results.
• Domain discovery
  • Levenshtein distance threshold (1 - 12).

Testing

Use the Test action in the channel list to send a confirmation message to a Slack channel. This helps verify your bot token and channel configuration.