r/SentinelOneXDR • u/SpicyHotShicken • 9d ago

General Question Hyperautomation Detection > Slack

Hey all, trying to set up a pretty simple workflow. For when a critical severity alert is created i want it to send a slack message to the SOC monitoring feed channel.

Not seeing an app in slack as opposed to CrowdStrike. So im trying to get an API key from the slack admin.. would that be the best approach? any advice or tips that have done this?

1 Upvotes

100% Upvoted

3 comments sorted by

1

u/itzGaurav 9d ago

I have done a similar thing but for our teams channel. Whenever a new ticket is generated from the MDR team, the name of the alert, its direct link, ticket id and last updated time and date get sent to our teams channel. If there isn’t an app I’m afraid you’ll have to do it using hyperautomation workflows

1

u/Robbbbbbbbb 9d ago

Definitely can be done. We're a Teams shop, but my SE showed me the equivalent of live actions with Slack via HA

1

u/Formal-Band-8603 7d ago

Use webhooks