> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/slack/slack-enterprise.md).

# Slack Enterprise

Configure Slack Enterprise identity and SaaS posture monitoring for Cortex XSIAM.

Secure configurations and monitor identity risks in Slack Enterprise.

This connector includes the following capabilities and sub-capabilities, if applicable:

* **Identity Posture**: Maintain visibility and control over Slack identities, including users, groups and roles. This capability is available with any active Cortex XSIAM, Cortex Cloud Posture Security, Cortex Cloud Runtime Security, or Cortex Data Security license.
* **SaaS Posture Configuration Monitoring**: Detect, monitor and alert on settings of your SAAS application. This capability is available with any active Cortex XSIAM or Cortex Cloud Posture Security license.
  * **saas-posture-config-remediation**: Help remediate the misconfigured security settings of your SAAS application. This sub-capability is available with any active Cortex XSIAM or Cortex Cloud Posture Security license.

<details>

<summary><strong>Security Posture</strong></summary>

### How to configure the Slack Enterprise connector

Cortex XSIAM connects to the Slack Enterprise API using a User OAuth Token generated from a Slack org-wide app that you create. A Slack org-wide app is deployed across all workspaces in your organization.

To access Slack Enterprise, Cortex XSIAM requires the following information, which you will specify during the connection process.

* User OAuth Token

#### **Task 1: Create an App to access your Slack Enterprise Instance**

**Step 1 — Identify the administrator account**

Identify the Slack administrator account you will use to create the org-wide app.

Required permissions: The account must be assigned to the Org Admin role or a role with greater permissions, because you will install the app across all workspaces in your organization.

**Step 2 — Create the Slack app**

1. Log in to the Slack API console and navigate to the Your Apps page at [api.slack.com/apps](https://api.slack.com/apps).
2. Click **Create New App**.
3. In the Create an app dialog, select From scratch.
4. In the Name app & choose workspace dialog, enter a name for your app and select a workspace. You will configure the app in this workspace and later deploy it across your organization.
5. Click **Create App**. Slack Enterprise displays the configuration settings for your new app.

**Step 3 — Configure the app scopes and opt in to org-wide deployment**

1. Navigate to OAuth and Permissions settings and locate the Scopes section.
2. Under Bot Token Scopes, click **Add an OAuth Scope** and select **team:read**.
3. Navigate to Org Level Apps settings and click **Opt in** to the org apps program.
4. Navigate back to OAuth and Permissions settings and locate the Scopes section.
5. Under User Token Scopes, click Add an OAuth Scope and add the following scopes:
   1. admin.teams:read
   2. auditlogs:read
   3. team:read
   4. admin.users:read (required for identity scans)

**Step 4 — Install the app and copy the User OAuth token**

1. In the OAuth and Permissions settings, locate the OAuth Tokens for Your Workspace section and click Install to Organization. Slack Enterprise generates tokens for your app.
2. Copy the User OAuth token and save it to a text file.

{% hint style="info" %}
**Note**: Do not proceed until you have copied the User OAuth Token. You must provide this token during onboarding when SaaS Security prompts you for an API Key.
{% endhint %}

#### **Task 2: Connect** Slack Enterprise **to Cortex XSIAM**

1. In Cortex XSIAM, navigate to **Settings** → **Data Sources & Integrations**.
2. Click **+ Add new**.
3. In the **Add Data Sources or Integrations** page, search for Slack Enterprise.
4. Under **Recommended**, hover over the new Slack Enterprise integration and click **Add Instance** to launch the configuration wizard.
5. Under the **Capabilities** tab, Enter a Name for your application.
6. Select Security Posture under **Default Capabilities**.
7. Click **Next**.
8. Under **Connection**, enter the User OAuth token in the API Key field.
9. Under **Configuration** tab, select a **Sync Interval**. Choose a meaningful **Tag** to distinguish between various applications in different environments.
10. A confirmation message indicates that Slack Enterprise is successfully connected. Confirm the Summary details and click **Save instance**.

</details>


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/slack/slack-enterprise.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.