Slack Integration

Slack integration

Use Slack to deliver alerting, analysis, and discovery notifications to selected channels.

Setup

1. In the app, go to Integrations and choose Slack.
2. Add the Slack bot token (starts with xoxb-) and optionally a signing secret.
3. Click Save connection.
4. Add one or more channels using their channel ID (and an optional label).
5. Configure event filters for each channel and enable delivery.

Tip

The signing secret is only needed for verifying interactive actions and events. For message delivery alone, the bot token is sufficient.

Event types

Slack notifications are sent for these event types:

• lookup_result.alerts - Alerts that match the configured filters.
• lookup_result.analysis - Analysis updates that exceed the phishing score threshold.
• lookup_result.domain_discovery - Newly discovered domains within the Levenshtein distance threshold.

Event filters

Each channel has its own filters:

• Alerts
  • Minimum severity: critical, high, medium, low, informational.
  • Status filter: stable, test, experimental, deprecated, unsupported.
• Analysis
  • Phishing score threshold (0.0 - 1.0).
  • Optional “only on change” toggle to skip duplicate results.
• Domain discovery
  • Levenshtein distance threshold (1 - 12).

Testing

Use the Test action in the channel list to send a confirmation message to a Slack channel to verify the bot token and channel configuration.