Slack
Slack is on a mission to make people’s working lives simpler, more
pleasant, and more productive. It is the productivity platform for customer companies that
improves performance by empowering everyone with no-code automation, making search and
knowledge sharing seamless, and keeping teams connected and engaged as they move work
forward together. As part of Salesforce, Slack is deeply
integrated into the Salesforce Customer 360, supercharging productivity
across sales, service and marketing teams. To learn more and get started with
Slack for free, visit slack.com
You can use AWS AppFabric for security to receive audit logs and user data from Slack, normalize the data into Open Cybersecurity Schema Framework (OCSF) format, and output the data to an Amazon Simple Storage Service (Amazon S3) bucket or an Amazon Data Firehose stream.
AppFabric support for Slack
AppFabric supports receiving user information and audit logs from Slack.
Prerequisites
To use AppFabric to transfer audit logs from Slack to supported destinations, you must meet the following requirements:
-
You must have an Enterprise Grid plan with Slack. For more information, see An introduction to Slack Enterprise Grid
on the Slack website. -
You must have a user with the Org Owner role in your Slack account. For more information about roles, see Types of roles in Slack
in the Slack Help Center on the Slack website.
Rate limit considerations
Slack imposes rate limits on the Slack API. For more
information about Slack API rate limits, see Rate limits
Data delay considerations
You might see up to a 30-minute delay for an audit event to be delivered to your
destination. This is due to delay in audit events made available by the application
as well as due to precautions taken to reduce data loss. However, this might be
customizable at an account-level. For assistance, contact AWS Support
Connecting AppFabric to your Slack account
After you create your app bundle within the AppFabric service, you must authorize AppFabric with Slack. To find the information required to authorize Slack with AppFabric, use the following steps.
Create an OAuth application
AppFabric integrates with Slack using OAuth. There are two ways to create an OAuth app: Using an app manifest or From scratch. To create an OAuth application in Slack, use the following steps.
Required scopes
Note
This section is only applicable if you chose to create the OAuth app from scratch. Skip this section if you chose to use app manifest to create an application authorization.
You must add the following user token scopes on the OAuth & Permissions page of your Slack OAuth application:
-
auditlogs:read
-
users:read.email
-
users:read
App authorizations
Tenant ID
AppFabric will request your tenant ID. The tenant ID in AppFabric is your
Slack workspace ID. To get your tenant ID, following the
instructions in Locate
your Slack URLexamplecorp.slack.com
or
examplecorp.enterprise.slack.com
. The tenant ID you need is
examplecorp
without .slack.com
or
.enterprise.slack.com
.
Tenant name
Enter a name that identifies your Slack workspace ID. AppFabric uses the tenant name to label the app authorizations and any ingestions created from the app authorization
Client ID
AppFabric will request the client ID from your Slack OAuth application. To find the client ID, use the following steps:
-
Navigate to the Slack App Management UI
in your browser. -
Choose the OAuth application that you use with AppFabric.
-
Enter the client ID from the Basic Information page into the Client ID field in AppFabric.
Client secret
AppFabric will request the client secret from your Slack OAuth application. To find the client secret, use the following steps:
-
Navigate to the Slack App Management UI
in your browser. -
Choose your the OAuth application that you use with AppFabric.
-
Enter the client secret from the Basic Information page into the Client secret field in AppFabric.
Approve authorization
After creating the app authorization in AppFabric, you will receive a pop-up window from Slack to approve the authorization. To approve the AppFabric authorization, choose allow.