Panther has the ability to fetch Slack audit logs by querying the Audit Logs API. Panther will query the api every 1 minute.

In order for Panther to access the Slack API you need to create a new 'Slack App' and provide the app credentials to Panther.

Create a new Slack Source in Panther

1. Login to your Panther account

2. Go to Log analysis > Sources from the sidebar menu

3. Click Add Source

4. Select Slack from the list of available types

1. Enter a name for the source (e.g. My Slack logs), then click Next

2. The next page asks you to enter the Client ID and the Client Secret of a Slack App with access to your Slack Audit logs. For now, click on Copy Redirect URL and save it somewhere temporarily, as you will need it later.

Create a new Slack App

In the following steps, you will be creating a Slack app with permissions to pull Audit logs from your Enterprise Grid workspaces. For security and availability reasons, we recommend creating a new Slack App that will be used only by Panther.

1. Go to Slack workspace sign-in​

2. Sign in to a workspace belonging to the Enterprise grid you want to monitor. You must sign-in as an owner of the organization!

3. You will be presented with a screen displaying all the workspaces in your Enterprise Grid. Click Launch in Slack on a workspace you are interested to monitor. You will be signed-in to that workspace.

4. Go to Slack apps and click Create New App

1. Enter an App Name e.g. Panther monitoring

2. Select the workspace you signed in earlier. Click on Create App.

The App will be created in the selected workspace but later you will be able to use to monitor the entire Enterprise Grid organization 7. Click OAuth & Permissions in the left navigation panel

1. Scroll down to the Redirect URLs section, click Add and put in the redirect url that you copied from the Panther wizard in the previous section, then click Save URLs

1. Scroll down to the section titled Scopes -> User Token Scopes. Add the auditlogs:read scope

1. In the app's settings, select Manage Distribution from the left navigation. Under the section titled Share Your App with Other Workspaces, select all four options

2. Click the green Activate Public Distribution button

1. Go to the Settings -> Basic Information in the left navigation panel

2. Go to App Credentials section. Copy the Client ID and Client Secret

Finalize Slack onboarding in Panther

1. Go back to the Slack onboarding wizard in the Panther UI

2. Paste Client ID and Client Secret credentials of the Slack App you just created

3. Click Next. The credentials will be stored, encrypted, in the Panther backend

4. Click Save Source

1. Click Authorize. You will be redirected to a Slack page to install your app. Make sure you install it to the Enterprise Organization and not to a specific workspace!

2. Click Allow

3. Your new Slack Source should be healthy and ready to fetch audit logs from Slack!