Announcing RUNWAY: The conference for teams securing what's nextRegister Now
RunReveal
Notifications

Slack Bot

Send detection alerts to a Slack channel through the RunReveal Slack bot. Messages are rendered as rich Block Kit blocks from your notification template. Delivery uses the workspace's installed bot token, so you pick a destination channel instead of pasting an incoming webhook URL.

Slack Bot notification channel in RunReveal

Three different Slack features. This page is the Slack Bot notification channel (detection alerts via the installed bot). For webhook-based alerts, see Slack (Incoming Webhook). For DM / @RunReveal agent chat, see Slack Bot integration.

How it works

  • Uses the installed Slack app. Alerts post with the workspace bot token stored when you install RunReveal under Settings → Integrations. There is no per-channel webhook secret.
  • Block Kit delivery. Template markdown is converted to Slack Block Kit. Long alerts split into follow-up messages in the same thread so the channel stays readable.
  • Channel membership required. The bot can only post to channels it has been invited to. The channel picker lists only those channels.
  • Thread-aware metadata. The root alert message stores detection identifiers so later work (for example mentioning @RunReveal on the alert thread) can tie the Slack thread back to the detection run.
  • Feature-gated. The channel type is available when the slack_bot feature is enabled for your workspace. Contact RunReveal if you do not see it.

Prerequisites

  1. The RunReveal Slack app is installed for your workspace (Slack Bot integration setup)
  2. The bot has been invited to the Slack channel that should receive alerts (/invite @RunReveal in that channel)
  3. Permission to create notification channels in RunReveal

If the Slack app is not installed yet, the Slack Bot card on the notification channels page explains that you need to connect it under Workspace → Integrations before you can add the channel.

Setup

Step 1: Install the Slack app (if needed)

  1. Go to Settings → Integrations
  2. Under Slack, choose a Bot role and click Install to Slack
  3. Approve the Slack OAuth consent screen

See the Slack Bot integration guide for account linking and bot role details. Account linking is required for interactive agent chat, not for posting detection alerts through this notification channel.

Step 2: Invite the bot to your alert channel

In Slack, open the channel that should receive RunReveal alerts and invite the bot:

/invite @RunReveal

Public and private channels both work, as long as the bot is a member.

Step 3: Create the notification channel in RunReveal

  1. Go to Notification Channels
  2. Click Add Notification Channel (or Connect on the Slack Bot card)
  3. Select Slack Bot
  4. Enter a Display Name and optional internal name
  5. Choose the Slack Channel from the dropdown (refresh the list if you just invited the bot)
  6. Click Test Notification to verify delivery
  7. Click Create Notification to save

The form stores the Slack channel ID as the delivery target. The channel name is cached for display only; if the channel is renamed in Slack, alerts still go to the same channel ID.

Step 4: Attach the channel to detections

Add the notification channel on individual detections, in Sigma / detection-as-code configs, or via bulk subscribe from the detection library. See Getting Started with Notifications.

Message format

Alerts use Handlebars notification templates. The default Slack Bot template (default_slackbot) includes the detection description, name, severity, row count when present, and a result link.

The rendered title becomes a Block Kit header; the body becomes the message content. You can override the template on the notification channel or create a custom template under Notification Templates.

Troubleshooting

Slack Bot card is blocked or missing

  • Confirm the Slack app is installed under Settings → Integrations
  • Confirm your workspace has the Slack bot feature enabled (contact RunReveal support if the card never appears)

Channel list is empty

  • Invite @RunReveal to the target Slack channel, then click the refresh control next to the channel picker
  • If the list fails to load, confirm the Slack app is still installed and reconnect if needed

Test or live alerts fail

  • Confirm the bot is still a member of the selected channel (removing it from the channel breaks delivery)
  • Check notification history for delivery errors
  • Prefer re-selecting the channel after re-inviting the bot rather than relying on a stale channel ID

Want agent chat on an alert thread

Posting the alert with this channel creates a Slack thread root the bot can recognize. Mentions and interactive investigation still require each user to link their Slack account. Use DMs for sensitive follow-ups; channel replies are visible to everyone in the channel.

Previous

Slack

Next

Discord

On this page