Slack

✅ Pre-requisites

User must have the AirMDR Slack API manifest in JSON format.
Follow the steps to generate AirMDR Slack API Manifest
Generate AirMDR Slack API Manifest

Navigate to AirMDR, provide the credentials, and click Login.

In the left navigation pane of the application, select Integrations.

Use the search option, enter the keyword “Slack”, select the Connections tab, and click Create.

In the Authentication Details, step 2 copy the pre-generated manifest to use in the Slack application.

or
Contact AirMDR support team to get the AirMDR Slack API manifest

Slack App Setup via Manifest

This guide provides step-by-step instructions for setting up a Slack App using a manifest file. It covers how to create the app, enable incoming Webhook URL, generate Signing Secret, and Bot Token — essential components for building and integrating bots, automations, and services with Slack’s API.

Slack APP Page - Create an App

Go to Slack API Page.
You can create a new Slack app here.
Click “Create New App” in the top right corner. A pop-up modal “Create an app” will show up.
Choose “From a manifest” and enter the required information:
- Pick a workspace to develop your app in: Select a workspace where you want to install the app. (e.g. airmdr)
Click Next.

Paste the JSON content [MANIFEST COPY] generated earlier from the AirMDR Integration Dashboard.

Sample Manifest

{
    "display_information": {
        "name": "AirMDR",
        "description": "Sends real-time messages to users for confirming security-related actions",
        "background_color": "#002b87"
    },
    "features": {
        "app_home": {
            "home_tab_enabled": false,
            "messages_tab_enabled": true,
            "messages_tab_read_only_enabled": false
        },
        "bot_user": {
            "display_name": "AirMDR",
            "always_online": true
        }
    },
    "oauth_config": {
        "scopes": {
            "bot": [
                "incoming-webhook",
                "users:read",
                "users:read.email",
                "chat:write",
                "im:write",
                "app_mentions:read",
                "im:history"
            ]
        }
    },
    "settings": {
        "event_subscriptions": {
            "request_url": "https://app.airmdr.com/airmdrapi/webhooks/slack/v1/events?token=XXX",
            "bot_events": [
                "message.im"
            ]
        },
        "interactivity": {
            "is_enabled": true,
            "request_url": "https://app.airmdr.com/airmdrapi/webhooks/slack/v1/interactions?token=XXX"
        },
        "org_deploy_enabled": false,
        "socket_mode_enabled": false,
        "token_rotation_enabled": false
    }
}

Optionally you can customise the JSON content information to easily identify the application.“display_information” → “name”: < your org name>“bot_user” → “display_name”: < your org name>

Click Next.
In the Review summary & create your app pop-up modal cross-verify the content and click Create.

Generate a Webhook URL

In the left navigation menu, navigate to Features → Incoming Webhooks.
Make sure the toggle option “Activate Incoming Webhooks” is On.
Scroll down to the “Webhook URLs for Your Workspace” section.
Click “Add New Webhook to Workspace”.
Select a channel in the drop-down list where you want the bot to post to.
Click “Allow” to grant permissions.
Once redirected, your Webhook URL will appear under Webhook URLs for Your Workspace.
Click Copy to save it for use.

Verify Event Subscription Request URL

Slack requires validation of your request URL to enable event subscriptions. To ensure your endpoint (e.g., https://yourdomain.com/slack/events) is publicly accessible and configured to handle Slack’s verification request (responds with the challenge value).

In the left navigation menu, navigate to Settings → Event Subscriptions.
Toggle Enable Events to On.
Click Retry button in the Request URL.
After successful verification, click Save Changes at the bottom.

Enable OAuth & Permissions

In the left navigation menu, navigate to Features → OAuth & Permissions.
In the OAuth Tokens section, click “Install to <your workspace>”.

Install the App and Get the Bot Token

In the “Where should <your workspace> post?”
Select a #channel in the drop-downlist where to post as an app.
Click Allow.
After authorization, your Bot User OAuth Token (xoxb-...) will appear under OAuth Tokens for Your Workspace.
Click Copy to store the token.
Click on Revoke Tokens button at the bottom of the page to Revoke All OAuth Tokens:
You can revoke all OAuth tokens if you want to invalidate the access any existing tokens have to Slack workspace data.
Users will need to grant your app permissions again to use it.

Obtain Signing Secret

In the left navigation menu, navigate to Settings → Basic Information.
Under App Credentials, locate the Signing Secret.
Click Show and then Copy. Store it in a secure location (e.g., secrets manager).

Retrieve Credentials

✅ Summary of Retrieved Credentials

Credential	Description
Webhook URL	Posts messages to selected Slack channels
Signing Secret	Verifies authenticity of incoming requests
Bot Token (starts with`xoxb-`)	Authenticates API calls made by your bot
Events URL	Receives Slack events via HTTP POST (e.g., messages)

Securely save and share the Webhook URL, Bot User OAuth Token and Signing Secret with the AirMDR support team to configure
or
Self configure Slack in the AirMDR Integrations Dashboard.

Evaluate Slack Bot User OAuth Token

Open cURL and run the following command to check if your API Key is working: Sample Request:

curl -X POST https://slack.com/api/auth.test \
  -H "Authorization: Bearer <xoxb-***your-bot-token***>"

Sample Response:

{
  "ok": true,
  "url": "https://yourteam.slack.com/",
  "team": "Your Team",
  "user": "bot-user-name",
  "team_id": "TXXXXXXX",
  "user_id": "UXXXXXXX"
}

If Invalid

{
  "ok": false,
  "error": "invalid_auth"
}

Skills Provided by this Integration

Skill ID	Purpose
Slack Checkpoint	This skill sends a Slack message to a specified user to confirm suspected activities. It is used within playbooks to pause execution, awaiting user confirmation. If no response is received within a set timeout, the playbook proceeds with subsequent actions. This is crucial for verifying user activities and deciding the next steps in incident response scenarios.
Send Slack Message	Send a message to a Slack channel using a webhook. This skill is useful for real-time notifications or alerts.

To view the details of Input Parameters and Output for the respective skills

Go to AirMDR → Slack Integration page.
Select the Skills tab and click on the required listed skills.

Configure Slack in the AirMDR Integrations Dashboard

Navigate to AirMDR, provide the credentials, and click Login.
Navigate to the AirMDR Integrations Dashboard in the left navigation pane and select Integrations.
Use the search option, enter the keyword “Slack”, select the Connections tab, and click Create.
Enter an unique name to the Instance (e.g., your org name-Slack) to easily identify the user connection by AirMDR.
Enter the Webhook URL, Slack channel name, Bot User OAuth Token and Signing Secret in the Authentication Details field params, and click Create.
Click the “Authenticate” button to authorize the connection and complete the setup.

Getting Started

AirMDR Detections

Integrations

API Reference

AirMDR Product Suite

✅ Pre-requisites

Slack App Setup via Manifest

✅ Summary of Retrieved Credentials

Evaluate Slack Bot User OAuth Token

Skills Provided by this Integration

Configure Slack in the AirMDR Integrations Dashboard

​✅ Pre-requisites

​Slack App Setup via Manifest

​✅ Summary of Retrieved Credentials

​Evaluate Slack Bot User OAuth Token

​Skills Provided by this Integration

​Configure Slack in the AirMDR Integrations Dashboard

✅ Pre-requisites

Slack App Setup via Manifest

✅ Summary of Retrieved Credentials

Evaluate Slack Bot User OAuth Token

Skills Provided by this Integration

Configure Slack in the AirMDR Integrations Dashboard