Skip to main content

Slack Integration

Receive instant security alerts in your Slack workspace.

Why Slack Integration?​

Connect CastellanAI to Slack to get security alerts where your team communicates. Configure custom filters, use threads for discussions, and respond faster to threats.

FeatureDescription
Real-TimeAlerts delivered instantly to your channels
ThreadedKeep conversations organized with threads
Rich FormatColor-coded blocks with actionable buttons

Setup Steps​

Step 1: Create a Slack Incoming Webhook​

Set up an incoming webhook in your Slack workspace:

  1. Go to api.slack.com/apps
  2. Click "Create New App" → "From scratch"
  3. Name it "CastellanAI Alerts" and select your workspace
  4. Navigate to "Incoming Webhooks" and activate it
  5. Click "Add New Webhook to Workspace"
  6. Select your #security-alerts channel (or create one)
  7. Copy the generated Webhook URL
warning

Security: Keep your webhook URL private - anyone with this URL can post messages to your Slack channel.

Step 2: Add Webhook to Portal​

Configure the webhook in CastellanAI:

  1. Login to your CastellanAI portal
  2. Navigate to Dashboard → Profile
  3. Scroll to Notification Settings
  4. Click "Add Slack Webhook"
  5. Paste your webhook URL and give it a name (e.g., "Security Team Channel")
  6. Click Save

Step 3: Configure Alert Preferences​

Customize which alerts get sent to Slack:

Recommended Settings:

SettingValueReason
Minimum SeverityHighPrevent alert fatigue - only send important events
Use ThreadsEnabledKeep conversations organized (recommended for busy channels)
Quiet HoursOptionalSuppress Low/Medium alerts outside business hours

Step 4: Test the Integration​

Send a test message to confirm everything works:

  1. Click "Send Test Alert" button in the portal
  2. Check your Slack channel for the test message
  3. Verify buttons and links work
tip

All Set! You'll now receive security alerts in Slack based on your configured filters.

Alert Format​

Slack alerts include rich formatting:

  • Color-coded sidebar - Red (Critical), Orange (High), Yellow (Medium), Blue (Low)
  • Event title - Clear, AI-generated summary of the threat
  • Details block - Hostname, timestamp, event type, user/process info
  • MITRE ATT&CK - Mapped tactics (e.g., "Initial Access, Execution")
  • Action buttons - "View in Portal", "Mark as Reviewed", "Take Action"

Best Practices​

  • Use Dedicated Channels - Create #security-critical and #security-all for different severity levels
  • Enable Notifications - Set Slack channel notifications to "All messages" for critical channels
  • Pin Important Alerts - Use Slack's pin feature for ongoing incidents
  • Create Workflows - Use Slack's workflow builder to automate responses (e.g., create tickets)

Troubleshooting​

No test message received​

Verify the webhook URL is correct in your portal settings. Test it directly using curl or Postman. Check if the Slack app is still installed in your workspace.

Alerts are too noisy​

Increase minimum severity to High or Critical. Use multiple webhooks for different channels based on severity.

Buttons don't work​

Ensure your Slack app has interactive components enabled. Links to the portal require users to be logged in.

What's Next?​