Skip to main content

CollectorsCloud Collectors Administration Guide

Prerequisites to Configure Slack Cloud Collector

Before you configure the Slack Cloud Collector, you must obtain the values for client ID and client secret by creating a Slack app for integration.

Obtain Client ID and Secret by Creating a Slack App

Slack APIs are authenticated via client ID and client secret. You must create a Slack app to obtain the values for client ID and client secret to use while configuring the Slack cloud collector.

To create a Slack app:

  1. Log in to Slack Enterprise Grid, and access https://api.slack.com/apps.

  2. Click Create New App.

  3. In the Create an app section, click From scratch.

    Slack_create_app.png

  4. Specify a name for the app, select the Slack workspace to which the app belongs, and click Create App.

  5. Navigate to OAuth & Permissions page.

  6. Click Add New Redirect URL and enter the URL in subscription url/app/collectors/cloud-collectors/oauth format in the Redirect URLs box. For example https://abc-xyz.staging.exabeam.cloud/app/collectors/cloud-collectors/oauth.

  7. Click Add New Redirect URL, then click Save URLs.

  8. After saving the Redirect URL, in the Advanced token security via token rotation section, click Opt In to enable the refresh token functionality. This allows the collector to generate a new access token using the refresh token.

    Redirect_URL_and_Opt_In.png

  9. Click Opt in in the confirmation box.

    Redirect_URL_and_Opt_In2.png

  10. Scroll down to the Scopes section.

  11. In the User Token Scopes section, select the scope auditlogs:read as this permission is required to allow interaction with the Audit Logs API.

    Scopes-User_token.png

  12. In the left pane, navigate to Settings > Basic Information.

  13. In the Settings section, click Manage Distribution.

  14. Click Distribute App.

  15. In the Share Your App with Other Workspaces section, click Remove Hard Coded Information.

    Note

    In the Share Your App with Other Workspaces section, ensure that you select the check boxes for all the available options such as Enable Features & Functionality, Add OAuth Redirect URLs, and Use HTTPS For Your Features.

  16. Select the I've reviewed and removed any hard-coded information check box.

  17. Click Activate Public Distribution.

  18. Initiate the OAuth handshake that will install the app:

    1. In Share Your App with Your Workspace, copy the Sharable URL and paste it into a browser of your organization.

      You must be logged in as the Owner of your Enterprise Grid organization to install the app.

    2. Verify the dropdown in the upper right of the installation screen to make sure you are installing the app on the Enterprise Grid organization, not an individual workspace within the organization.

      After your app completes the OAuth flow, you will be granted an OAuth token that you can use to call all of the Audit Logs API methods for your organization.

    For more information, see the Slack documentation.

  19. In the left pane, navigate to Settings > Basic Information > App Credentials.

    client_id.png

  20. Copy the values for Client ID and Client Secret to use for authorizing the API calls. Use these values, represented by a string of letters and numbers, to configure the Slack cloud collector.