Setting Up Slack Notifications

Get real-time security alerts delivered directly to your Slack channels. This guide walks you through setting up Slack notifications for LiteSOC events.

Overview

With Slack notifications, you can:

• 🚨 Receive instant alerts for security threats
• 👀 Monitor login attempts and suspicious activity
• 🔔 Get notified about brute force and impossible travel detections
• 📊 Share security updates with your team

Method 1: Using LiteSOC Built-in Slack Integration

Step 1: Connect Slack

1. Log in to your LiteSOC Dashboard
2. Go to Settings → Integrations
3. Find Slack and click Connect
4. You'll be redirected to Slack to authorize LiteSOC
5. Select the workspace and channels you want to allow
6. Click Allow

Step 2: Configure Notification Settings

After connecting, configure which events trigger notifications:

Step 3: Test the Integration

Click Send Test Notification to verify everything works. You should see a message in your selected channel.

Method 2: Using Slack Incoming Webhooks

For more control, use Slack Incoming Webhooks directly.

Step 1: Create a Slack App

1. Go to api.slack.com/apps
2. Click Create New App → From scratch
3. Name your app (e.g., "LiteSOC Alerts")
4. Select your workspace

Step 2: Enable Incoming Webhooks

1. In your app settings, go to Incoming Webhooks
2. Toggle Activate Incoming Webhooks to ON
3. Click Add New Webhook to Workspace
4. Select the channel for alerts (e.g., #security-alerts)
5. Click Allow
6. Copy the Webhook URL

Example Webhook URL:
https://hooks.slack.com/services/T00000000/B00000000/XXXXXXXXXXXXXXXXXXXXXXXX

Step 3: Configure in LiteSOC

1. Go to Settings → Webhooks in LiteSOC
2. Click Add Webhook
3. Select Slack as the destination type
4. Paste your Slack Webhook URL
5. Configure filters (event types, severity)
6. Click Save

Customizing Alert Messages

Alert Format

LiteSOC sends rich Slack messages with:

┌────────────────────────────────────────┐
│ 🚨 Security Alert                      │
├────────────────────────────────────────┤
│ Event: auth.login.failure              │
│ Severity: 🔴 Critical                  │
│                                        │
│ Actor: user@example.com                │
│ IP: 203.0.113.42                       │
│ Location: 📍 Unknown (VPN detected)   │
│                                        │
│ Detection: Brute Force Attack          │
│ Failed attempts: 15 in 5 minutes       │
│                                        │
│ [View in Dashboard]                    │
└────────────────────────────────────────┘

Severity Colors

• 🔴 Critical - Red sidebar
• 🟠 High - Orange sidebar
• 🟡 Medium - Yellow sidebar
• 🟢 Low/Info - Green sidebar

Channel Recommendations

We recommend setting up multiple channels for different alert types:

Filtering Notifications

By Event Type

Select specific events to receive notifications for:

• ✅ auth.login.failure
• ✅ security.suspicious.activity
• ✅ admin.role.changed
• ❌ auth.login.success (too noisy)

By Severity

Filter based on severity level:

• Critical Only - Brute force, impossible travel, blocked threats
• High and Above - Includes failed logins, suspicious activity
• Medium and Above - Includes permission changes
• All - Every security event (can be noisy)

By Actor

Optionally filter for specific users or groups:

• VIP users (executives, admins)
• New users (first 30 days)
• Service accounts

Setting Up Quiet Hours

Avoid alert fatigue with quiet hours:

1. Go to Settings → Integrations → Slack
2. Enable Quiet Hours
3. Set your quiet period (e.g., 10 PM - 8 AM)
4. Choose how to handle alerts during quiet hours:
   • Suppress - Don't send any notifications
   • Batch - Send a summary at the end of quiet hours
   • Critical Only - Only send critical alerts

Troubleshooting

Not Receiving Notifications

1. Check channel permissions - Ensure the LiteSOC app can post to your channel
2. Verify webhook URL - The URL should start with https://hooks.slack.com/
3. Test the webhook - Use the "Send Test" button in LiteSOC
4. Check Slack app status - Ensure the app isn't disabled in Slack

Duplicate Notifications

If you're receiving duplicates:

1. Check if you have multiple webhooks configured
2. Ensure you're not using both built-in Slack and n8n integration
3. Review your notification rules for overlaps

Webhook Errors

If LiteSOC shows webhook errors:

1. 401/403 - Re-authorize the Slack connection
2. 404 - The webhook URL may have been revoked; create a new one
3. 500 - Slack is having issues; check status.slack.com

Best Practices

1. Don't over-notify - Only send actionable alerts to avoid fatigue
2. Use severity filters - Critical events need immediate attention
3. Create runbooks - Document response procedures for each alert type
4. Review regularly - Audit your notification settings monthly
5. Use threads - Group related alerts (available with built-in integration)

Need help? Check our webhook documentation or contact support.