Slack Configuration

1. Overview

Slack is a messaging application for business. It transforms the way that organisations communicate by bringing people together to work as one unified team.

2. Configuration

• In the Configuration Box, enter the Configuration Name to uniquely identify this configuration. Follow the initial setup steps described in How to Configure Automation? in the Bloo Knowledge Base.
• Create a webhook for a Slack channel in your account. Refer to the Sending messages using incoming webhooks — Slack API guide for setup instructions.
• Identify the content of headers and payload that you need to provide in the Configuration Box. Refer to the Slack API documentation for the payload format.

**Note: Use Slack App Webhooks (Recommended)**Slack has two ways to create incoming webhooks:1. Legacy Incoming Webhooks app — Slack marks this as deprecated. No end-of-life date has been set and existing webhook URLs continue to work. However, Slack does not recommend creating new ones using this method.2. Slack App-based incoming webhooks — This is the current recommended method. Create a Slack App, enable Incoming Webhooks, and install it to your workspace to generate a webhook URL.Both methods produce the same URL format (https://hooks.slack.com/services/...) and work identically with Bloo's automation. No changes are needed to the payload or Bloo configuration.If you are setting up a new webhook, use the Slack App method. If you already have a working legacy webhook URL configured in Bloo, your automation is unaffected.Source: Slack API documentation — api.slack.com/messaging/webhooks

Below is an example of how you can leverage this integration to send alerts to your Slack Channel.

Payload

{ "text": "Alert from Bloo - Found Suspicious Remote Desktop Activity on host DstIP" }Copy

Slack API delivers the text mentioned in the Payload to your Slack channel. This plugin is basically provisioned to replace the SrcIP, DstIP variables with the value received from the data stack received on running a Search block.

In the above figure, a workbook named Suspicious Remote Desktop Network Activity is executed which contains the following blocks:

• SQL Block: Displays two suspicious Destination IPs on execution of the workbook.
• Signal Block: This will raise a signal on detecting the suspicious IPs.
• DQL Block with _trigger query: Using Generic Webhook plugin for Slack, an alert will be raised to the Slack channel with the message mentioned in the payload as displayed below:

3. Related Links

• How to Configure Automation? — Bloo Knowledge Base
• Sending Messages Using Incoming Webhooks — Slack API Documentation