Community
Questions Library
Docs
Blog
Events
Swag
Github
Slack
JupiterOne
Discussions
Release Notes
Contact Us
Slack - AskJ1 Community
<main> <article class="userContent"> <h2 data-id="slack-jupiterone-integration-benefits">Slack + JupiterOne Integration Benefits</h2> <ul><li>Visualize Slack teams, channels, and users in the JupiterOne graph.</li> <li>Map Slack users to employees in your JupiterOne account.</li> <li>Map Slack users to the channels they have access to.</li> <li>Monitor changes to Slack teams, channels, and users using JupiterOne alerts.</li> <li>Create issues within Slack channels or directly to Slack users from JupiterOne<br> alerts.</li> </ul><h2 data-id="how-it-works">How it Works</h2> <ul><li><p>JupiterOne periodically fetches Slack teams, channels, and users to update the<br> graph.</p></li> <li><p>Write JupiterOne queries to review and monitor updates to the graph.</p></li> <li>Configure alerts to use the Slack workflow option to notify a channel or user.</li> <li>Configure alerts to take action when the JupiterOne graph changes.</li> </ul><h2 data-id="requirements">Requirements</h2> <ul><li><p>JupiterOne requires the JupiterOne Slack app be installed in your Slack<br> account with the requested OAuth scopes selected.</p></li> <li><p>You must have permission in JupiterOne to install new integrations.</p></li> </ul><h2 data-id="support">Support</h2> <p>If you need help with this integration, please contact<br><a rel="nofollow" href="https://support.jupiterone.io">JupiterOne Support</a>.</p> <h2 data-id="integration-walkthrough">Integration Walkthrough</h2> <p>Customers must install the JupiterOne Slack app and specify which<br><a rel="nofollow" href="https://api.slack.com/legacy/oauth-scopes">Slack OAuth scopes</a> the app should<br> request. Once the app is installed, the JupiterOne integration can begin<br> ingesting relevant information and send notifications via the<br><a rel="nofollow" href="https://jupiterone.com/features/rules-alerting/">JupiterOne Rules and Alerting feature</a>.</p> <h3 data-id="in-slack">In Slack</h3> <ol><li>First navigate to the JupiterOne integration for Slack configuration page (see<br> detailed steps in the <strong>In JupiterOne</strong> section below)</li> <li>Fill out relavant integration instance form information and OAuth scopes that<br> you'd like the Slack app to request. All read scopes are used to ingest data<br> into the JupiterOne graph and the write scopes are used for enabling the<br> ability to send notifications to channels in the configured Slack team. NOTE:<br><a rel="nofollow" href="https://api.slack.com/scopes/chat:write"><code class="code codeInline" spellcheck="false" tabindex="0">chat:write</code></a> is required to post<br> messages in channels & conversations that the <code class="code codeInline" spellcheck="false" tabindex="0">@JupiterOne</code> bot is a member<br> of and <a rel="nofollow" href="https://api.slack.com/scopes/chat:write.public"><code class="code codeInline" spellcheck="false" tabindex="0">chat:write.public</code></a><br> is required to post messages to channels that the <code class="code codeInline" spellcheck="false" tabindex="0">@JupiterOne</code> bot isn't a<br> member of. Without one or both of <code class="code codeInline" spellcheck="false" tabindex="0">chat:write</code> and <code class="code codeInline" spellcheck="false" tabindex="0">chat:write.public</code><br> scopes, users <em>will not</em> be able to configure JupiterOne alert rules with a<br> Slack notification.</li> <li>Once the relevant form information has been filled out, submitting the form<br> will redirect the user to Slack to authorize the requested scopes.</li> <li>Review the request scopes, click "Allow", and then you will be redirected<br> back to JupiterOne.</li> </ol><p>NOTE: Some permissions are tied to the user who installs the JupiterOne Slack<br> application. For example, if a non-Admin level user installs the application on<br> behalf of a workspace, the integration will not have the ability to ingest data<br> on which users have two factor authentication enabled within Slack. It is<br> recommended that an Administrator or Owner install the application.</p> <h3 data-id="in-jupiterone">In JupiterOne</h3> <ol><li>From the top navigation of the J1 Search homepage, select <strong>Integrations</strong>.</li> <li>Scroll to the <strong>Slack</strong> integration tile and click it.</li> <li>Click the <strong>Add Configuration</strong> button and configure the following settings:</li> </ol><ul><li><p>Enter the <strong>Account Name</strong> by which you'd like to identify this Slack account<br> in JupiterOne. Ingested entities will have this value stored in<br><code class="code codeInline" spellcheck="false" tabindex="0">tag.AccountName</code> when <strong>Tag with Account Name</strong> is checked.</p></li> <li><p>Enter a <strong>Description</strong> that will further assist your team when identifying<br> the integration instance.</p></li> <li><p>Select a <strong>Polling Interval</strong> that you feel is sufficient for your monitoring<br> needs. You may leave this as <code class="code codeInline" spellcheck="false" tabindex="0">DISABLED</code> and manually execute the integration.</p></li> <li><p>Select the <strong>Slack OAuth Scopes</strong> or permissions the JupiterOne Slack app<br> should request. (See the section <strong>In Slack</strong> above).</p></li> </ul><ol start="4"><li>Click <strong>Create Configuration</strong> once all values are provided.</li> </ol><h3 data-id="jupiterone-alert-rule-slack-notification">JupiterOne Alert Rule Slack Notification</h3> <p>NOTE: For detailed instructions on how to configure JupiterOne Alert Rules,<br> please see the<br><a rel="nofollow" href="https://support.jupiterone.io/hc/en-us/articles/360022720474-6-9-Alerts-and-Alert-Rules">JupiterOne Alert Rule configuration documentation</a>.<br> Additionally, see the<br><a rel="nofollow" href="https://support.jupiterone.io/hc/en-us/articles/360039711354-Alert-Rule-Schema">JupiterOne Alert Rule Schema documentation</a><br> for technical details on alert rule/action properties.</p> <p>JupiterOne can deliver Slack messages directly to any channel or to specific<br> users in a Slack Channel once the JupiterOne integration for Slack has been<br> configured via the JupiterOne web app. This will prompt the JupiterOne Slack app<br> to be installed in your Workspace.</p> <p>Be sure to include specify the channel in the format <code class="code codeInline" spellcheck="false" tabindex="0">#channel</code>. You can alert<br> to private channels as well if you have invited the JupiterOne Slack app to the<br> private channel as well.</p> <h2 data-id="how-to-uninstall">How to Uninstall</h2> <ol><li>From the top navigation of the J1 Search homepage, select <strong>Integrations</strong>.</li> <li>Scroll to the <strong>Slack</strong> integration tile and click it.</li> <li>Identify and click the <strong>integration to delete</strong>.</li> <li>Click the <strong>trash can</strong> icon.</li> <li>Click the <strong>Remove</strong> button to delete the integration.</li> </ol><h2 data-id="data-model">Data Model</h2> <h3 data-id="entities">Entities</h3> <p>The following entities are created:</p> <table><thead><tr><th>Resources</th> <th>Entity <code class="code codeInline" spellcheck="false" tabindex="0">_type</code></th> <th>Entity <code class="code codeInline" spellcheck="false" tabindex="0">_class</code></th> </tr></thead><tbody><tr><td>Channel</td> <td><code class="code codeInline" spellcheck="false" tabindex="0">slack_channel</code></td> <td><code class="code codeInline" spellcheck="false" tabindex="0">Channel</code></td> </tr><tr><td>Team</td> <td><code class="code codeInline" spellcheck="false" tabindex="0">slack_team</code></td> <td><code class="code codeInline" spellcheck="false" tabindex="0">Account</code></td> </tr><tr><td>User</td> <td><code class="code codeInline" spellcheck="false" tabindex="0">slack_user</code></td> <td><code class="code codeInline" spellcheck="false" tabindex="0">User</code></td> </tr></tbody></table><h3 data-id="relationships">Relationships</h3> <p>The following relationships are created:</p> <table><thead><tr><th>Source Entity <code class="code codeInline" spellcheck="false" tabindex="0">_type</code></th> <th>Relationship <code class="code codeInline" spellcheck="false" tabindex="0">_class</code></th> <th>Target Entity <code class="code codeInline" spellcheck="false" tabindex="0">_type</code></th> </tr></thead><tbody><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">slack_channel</code></td> <td><strong>HAS</strong></td> <td><code class="code codeInline" spellcheck="false" tabindex="0">slack_user</code></td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">slack_team</code></td> <td><strong>HAS</strong></td> <td><code class="code codeInline" spellcheck="false" tabindex="0">slack_user</code></td> </tr></tbody></table><p><a rel="nofollow" href="https://www.jupiterone.com/privacy-policy">Privacy Policy</a></p> </article> </main>
.png)