Slack Enterprise

Configure Slack Enterprise identity and SaaS posture monitoring for Cortex XSIAM.

Secure configurations and monitor identity risks in Slack Enterprise.

This connector includes the following capabilities and sub-capabilities, if applicable:

• Identity Posture: Maintain visibility and control over Slack identities, including users, groups and roles. This capability is available with any active Cortex XSIAM, Cortex Cloud Posture Security, Cortex Cloud Runtime Security, or Cortex Data Security license.

• SaaS Posture Configuration Monitoring: Detect, monitor and alert on settings of your SAAS application. This capability is available with any active Cortex XSIAM or Cortex Cloud Posture Security license.

  • saas-posture-config-remediation: Help remediate the misconfigured security settings of your SAAS application. This sub-capability is available with any active Cortex XSIAM or Cortex Cloud Posture Security license.

Security Posture

How to configure the Slack Enterprise connector

Cortex XSIAM connects to the Slack Enterprise API using a User OAuth Token generated from a Slack org-wide app that you create. A Slack org-wide app is deployed across all workspaces in your organization.

To access Slack Enterprise, Cortex XSIAM requires the following information, which you will specify during the connection process.

• User OAuth Token

Task 1: Create an App to access your Slack Enterprise Instance

Step 1 — Identify the administrator account

Identify the Slack administrator account you will use to create the org-wide app.

Required permissions: The account must be assigned to the Org Admin role or a role with greater permissions, because you will install the app across all workspaces in your organization.

Step 2 — Create the Slack app

1. Log in to the Slack API console and navigate to the Your Apps page at api.slack.com/apps.

2. Click Create New App.

3. In the Create an app dialog, select From scratch.

4. In the Name app & choose workspace dialog, enter a name for your app and select a workspace. You will configure the app in this workspace and later deploy it across your organization.

5. Click Create App. Slack Enterprise displays the configuration settings for your new app.

Step 3 — Configure the app scopes and opt in to org-wide deployment

1. Navigate to OAuth and Permissions settings and locate the Scopes section.

2. Under Bot Token Scopes, click Add an OAuth Scope and select team:read.

3. Navigate to Org Level Apps settings and click Opt in to the org apps program.

4. Navigate back to OAuth and Permissions settings and locate the Scopes section.

5. Under User Token Scopes, click Add an OAuth Scope and add the following scopes:

   1. admin.teams:read

   2. auditlogs:read

   3. team:read

   4. admin.users:read (required for identity scans)

Step 4 — Install the app and copy the User OAuth token

1. In the OAuth and Permissions settings, locate the OAuth Tokens for Your Workspace section and click Install to Organization. Slack Enterprise generates tokens for your app.

2. Copy the User OAuth token and save it to a text file.

Note: Do not proceed until you have copied the User OAuth Token. You must provide this token during onboarding when SaaS Security prompts you for an API Key.

Task 2: Connect Slack Enterprise to Cortex XSIAM

1. In Cortex XSIAM, navigate to Settings → Data Sources & Integrations.

2. Click + Add new.

3. In the Add Data Sources or Integrations page, search for Slack Enterprise.

4. Under Recommended, hover over the new Slack Enterprise integration and click Add Instance to launch the configuration wizard.

5. Under the Capabilities tab, Enter a Name for your application.

6. Select Security Posture under Default Capabilities.

7. Click Next.

8. Under Connection, enter the User OAuth token in the API Key field.

9. Under Configuration tab, select a Sync Interval. Choose a meaningful Tag to distinguish between various applications in different environments.

10. A confirmation message indicates that Slack Enterprise is successfully connected. Confirm the Summary details and click Save instance.