If you're having trouble at any stage please contact us at support@skyformation.com. 

Preface

• Get all activities and events from Slack collaboration channels
• Enrich the events with entities information
• Make the granular events available at the organization’s central log or event management system for compliance, investigation or forensic needs.
• Detect security threats and policy violations 

What is it

SkyFormation for Slack Enterprise Grid Cloud Connector, is part of the SkyFormation Collect (c) module.
It continuously retrieves events and alerts from the different sources in the Slack account, unifies the events into a common application events format, enriches the events with needed detection context and send the events to any existing SIEM/SOC system. 

How it works

SkyFormation for Slack Enterprise Grid Connector retrieves the events from the Slack service through its APIs. Before sending the events to the existing SIEM/SOC system the connector will

• Unify the events into the SkyFormation unified application events format
• Embed the origin event into the SkyFormation event as a blob
• Parse the origin event into a set of dedicated key-value key pairs fields
• Enrich the event with detection context (e.g. identity information)
• Encode the resulted event into the target SIEM/SOC system standard format (e.g. CEF)
• Send the event to the existing SIEM/SOC system over syslog

Connector's API/Audit Sources & Events Supported

How to on-board Slack Enterprise Grid Cloud Connector to SkyFormation app

Adding SkyFormation for Slack Enterprise Grid cloud connector