Setup Slack alerts

1. Create a Slack app

Go to the Slack page to create apps and create a new app (from scratch). Call it ”Elementary” and connect it to the workspace of your choice.

2. Optional - Slack app display

To change the display of the Elementary slack app, scroll down on the Slack app basic information page to the ‘Display Information’ section:

Here is the Elementary icon for your use (click to download):

1. Create a Slack token

Go to the “OAauth & Permissions” page for your newly-created app, and add the following scopes under “Bot Token Scopes”:

• channels:join - Join public channels in a workspace
• channels:read - View basic information about public channels in a workspace
• chat:write - Send messages as <app>
• files:write - Upload, edit, and delete files as <app>
• users:read - View people in a workspace
• users:read.email - View email addresses of people in a workspace
• groups:read - View basic information about private channels that your slack app has been added to

2. Install app at your Workspace

At the “OAuth & Permissions” page, press on “Install to Workspace” in order to generate Slack token:

Create a webhook

Go to the ‘Incoming Webhooks’ page for your newly-created app and toggle ‘Activate Incoming Webhooks’ to turn it on. Then click on ‘Add New Webhook to Workspace’:

Select the channel that the notifications will be posted to:

Token:

Use the Slack token when you execute edr monitor using the option -st, --slack-token and -ch, --slack-channel-name:

edr monitor --slack-token <your_slack_token> --slack-channel-name <slack_channel_to_post_at>

Webhook:

Use the webhook URL when you execute edr monitor using the option -s, --slack-webhook:

edr monitor --slack-webhook <your_slack_webhook_url>

The CLI reads the Slack integration from a file, copy it into a file called config.yml. Create it here: HOME_DIR/.edr/config.yml

Here is the format in the yml itself:

Token:

slack:
  token: <your_slack_token>
  channel_name: <slack_channel_to_post_at>
  group_alerts_by: <"table"> or <"alert">

# optional #
timezone: <optional_timezone_for_timestamps>

Webhook:

slack:
  notification_webhook: <your_slack_webhook_url>
  group_alerts_by: <"table"> or <"alert">
  # optional #
  workflows: false

# optional #
timezone: <optional_timezone_for_timestamps>