Configure audit log anomaly event responses in Slack
Configure audit log anomaly event responses in Slack
On the Enterprise Grid subscription, you can use the Slack audit logs to monitor usage in your organisation. Audit logs include anomaly events, which serve as indicators of potentially unusual or suspicious user and app activity. You can configure an anomaly event response if you’d like Slack to automatically end a user’s sessions across all devices for the following:
Accessing Slack from a Tor exit node
Data scraping
Excessive downloads
Stale or unexpected session cookies
Unexpected API call volume
Unexpected user agents
Configure anomaly event responses
In general, you should consider investigating anomaly events in your audit logs to understand the circumstances of the activity before taking action. However, you can choose to automatically end a user’s sessions when an anomaly event is detected to halt the potentially suspicious activity. If a user’s sessions end in response to an anomaly event, they can immediately sign back in to Slack using their usual sign-in credentials.
From your desktop, click your organisation name in the sidebar.
Hover over Tools & settings, then click Organisation settings.
From the left-hand sidebar, select Security, then click Security settings.
Under Anomaly event response settings, click Enable or Edit.
Tick or untick the box next to Automatically end user sessions in response to anomaly events, then select the anomaly events.
When a user’s active sessions end in response to an anomaly event, they’ll receive an email notification from Slack. You can decide whether the org primary owner and security admins should also be notified, and whether they receive an email or a notification in Slack.
From your desktop, click your organisation name in the sidebar.
Hover over Tools & settings, then click Organisation settings.
From the left-hand sidebar, select Security, then click Security settings.
Under Anomaly event response settings, click Enable or Edit.
Tick the box next to Automatically end user sessions in response to anomaly events, then select which anomaly events should automatically end user sessions.
Under Send notifications to, select who should be notified, and tick the box next to the type of notification they’ll receive.
Click Enable or Save.
Who can use this feature?
Org owners, org admins and members with the security adminsystem role
