Slack Integration
Version 1.33.0 (View all)
Managed integration release status GA
Subscription level
What's this?		 Basic
Developed by
What's this?		 Elastic
Ingestion method(s) API
Minimum Kibana version(s) 9.1.4
9.0.7
8.19.4
Important - Managed integrations on Elastic Cloud Hosted

You can use this integration as an Elastic Managed integration on Elastic Cloud Hosted deployments running this version or later.

Slack is used by numerous orgazations as their primary chat and collaboration tool.

The Slack integration uses Slack's API to retrieve audit events and ingest them into Elasticsearch. This allows you to search, observe, and visualize the Slack log events through Elasticsearch.

The Elastic agent running this integration interacts with Slack's infrastructure using their APIs to retrieve audit logs for a workspace or enterprise.

Please note the Audit Logs API is only available to Slack workspaces on an Enterprise Grid plan. These API methods will not work for workspaces on a Free, Standard, or Business+ plan.

Elastic Managed integrations are only supported on Elastic Cloud Serverless and Elastic Cloud Hosted deployments. An Elastic Managed integration lets you ingest data from a cloud source while avoiding the orchestration, management, and maintenance associated with standard ingest infrastructure. Elastic runs the collector for you, so you can focus on your data instead of the infrastructure that collects it.

For more information, refer to Elastic Managed integrations and the Elastic Managed integrations FAQ.

  1. In Kibana go to Management > Integrations
  2. In the "Search for integrations" search bar type Slack.
  3. Click on "Slack" integration from the search results.
  4. Click on Add Slack button to add Slack integration.

Enter values "OAuth API Token".

  1. OAuth API Token will be generated when a Slack App is created.

For the Slack integration to be able to successfully get logs the following "User Token Scopes"" must be granted to the Slack App:

  • auditlogs:read

Audit logs summarize the history of changes made within the Slack Enterprise.

Exported fields
Field Description Type
@timestamp Event timestamp. date
cloud.image.id Image ID for the cloud instance. keyword
data_stream.dataset Data stream dataset name. constant_keyword
data_stream.namespace Data stream namespace. constant_keyword
data_stream.type Data stream type. constant_keyword
event.dataset Event dataset constant_keyword
event.module Event module constant_keyword
host.containerized If the host is a container. boolean
host.os.build OS build information. keyword
host.os.codename OS codename, if any. keyword
input.type Type of Filebeat input. keyword
log.flags Flags for the log file. keyword
log.offset Offset of the entry in the log file. long
slack.audit.actor.type The type of entity performing the action. keyword
slack.audit.actor.user.team The the team of the actor if they are a user. keyword
slack.audit.context.domain The domain of the Workspace or Enterprise keyword
slack.audit.context.id The ID of the workspace or enterprise keyword
slack.audit.context.name The name of the workspace or enterprise keyword
slack.audit.context.session_id The identifier that is unique to each authenticated session. keyword
slack.audit.context.type The type of account. Either Workspace or Enterprise keyword
slack.audit.details.arguments The arguments an AI app passed to a Slack MCP server tool when event.action ends in _tool_called. The shape depends on the tool, so nested keys are stored as dotted leaf fields. object
slack.audit.details.location The location the activity occured in when event.action is anomaly keyword
slack.audit.details.md5 The md5 hash of a file associated with a file_malicious_content_detected event. keyword
slack.audit.details.previous_ip_address The IP address previously observed for the entity in the event when event.action is anomaly ip
slack.audit.details.previous_user_agent The User-Agent string previously observed for the entity in the event when event.action is anomaly keyword
slack.audit.details.reason The anomaly rule triggered to generate the event when event.action is anomaly: asn, excessive_downloads, ip_address, session_fingerprint, tor, user_agent keyword
slack.audit.details.tool The Slack MCP server tool an AI app called when event.action ends in _tool_called. keyword
slack.audit.details.url_private URL associated with the action. keyword
slack.audit.entity.barriered_from_usergroup The user group barrier when entity_type is barrier keyword
slack.audit.entity.channel The channel the entity is within when entity_type is message keyword
slack.audit.entity.domain Domain of the entity when entity_type is Workspace or Enterprise keyword
slack.audit.entity.email Email address of the entity when entity_type is user keyword
slack.audit.entity.entity_type Type of the entity: workspace, enterprise, user, file, channel, app, workflow, user, usergroup, barrier, message, role, account_type_role. keyword
slack.audit.entity.filetype Filetype of the entity when entity_type is file keyword
slack.audit.entity.id ID of the entity keyword
slack.audit.entity.is_directory_approved If App is approved when entity_type is app boolean
slack.audit.entity.is_distributed If App is distributed when entity_type is app boolean
slack.audit.entity.is_org_shared If channel is shared when entity_type is channel boolean
slack.audit.entity.is_shared If channel is shared when entity_type is channel boolean
slack.audit.entity.is_workflow_app If App is a workflow when entity_type is app boolean
slack.audit.entity.name Name of the entity keyword
slack.audit.entity.primary_usergroup The primary user group when entity_type is barrier keyword
slack.audit.entity.privacy Privacy status of entity when entity_type is channel keyword
slack.audit.entity.scopes The OAuth scopes when entity_type is app keyword
slack.audit.entity.team Team that the entity exists within when entity_type is user or message keyword
slack.audit.entity.teams_shared_with List of orgs channel is shared with when entity_type is channel keyword
slack.audit.entity.timestamp The timestamp of the entity when entity_type is message keyword
slack.audit.entity.title Title of the entity when entity_type is file keyword
slack.audit.entity.type The type of the entity when entity_type is role keyword
Example 
{
    "@timestamp": "2023-01-13T17:40:21.862Z",
    "agent": {
        "ephemeral_id": "4493e0ba-0e9b-43e7-ad59-2a2c6c330c73",
        "id": "6790db85-6c1f-425a-a093-87887eed5a5d",
        "name": "elastic-agent-86233",
        "type": "filebeat",
        "version": "8.19.4"
    },
    "data_stream": {
        "dataset": "slack.audit",
        "namespace": "54041",
        "type": "logs"
    },
    "ecs": {
        "version": "8.11.0"
    },
    "elastic_agent": {
        "id": "6790db85-6c1f-425a-a093-87887eed5a5d",
        "snapshot": false,
        "version": "8.19.4"
    },
    "event": {
        "action": "anomaly",
        "agent_id_status": "verified",
        "created": "2025-12-05T07:31:29.085Z",
        "dataset": "slack.audit",
        "id": "2125fb41-c67c-4cf5-a5c4-d90cb58dd5f9",
        "ingested": "2025-12-05T07:31:30Z",
        "kind": "event",
        "original": "{\"action\":\"anomaly\",\"actor\":{\"type\":\"user\",\"user\":{\"email\":\"aaron@example.com\",\"id\":\"e65b0f5c\",\"name\":\"roy\"}},\"context\":{\"ip_address\":\"81.2.69.143\",\"location\":{\"domain\":\"Docker\",\"id\":\"e65b11aa\",\"name\":\"Docker\",\"type\":\"workspace\"},\"ua\":\"Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:23.0) Gecko/20131011 Firefox/23.0\"},\"date_create\":1683836273,\"details\":{\"action_timestamp\":1673631621862,\"location\":\"England, GB\",\"previous_ip_address\":\"175.16.199.64\",\"previous_ua\":\"\",\"reason\":[\"asn\",\"ip_address\"]},\"entity\":{\"type\":\"user\",\"user\":{\"email\":\"jbob@example.com\",\"id\":\"asdfasdf\",\"name\":\"Joe Bob\",\"team\":\"T234SAH2\"}},\"id\":\"2125fb41-c67c-4cf5-a5c4-d90cb58dd5f9\"}",
        "type": [
            "info"
        ]
    },
    "input": {
        "type": "httpjson"
    },
    "related": {
        "ip": [
            "81.2.69.143"
        ],
        "user": [
            "e65b0f5c",
            "aaron@example.com"
        ]
    },
    "slack": {
        "audit": {
            "actor": {
                "type": "user"
            },
            "context": {
                "domain": "Docker",
                "id": "e65b11aa",
                "name": "Docker",
                "type": "workspace"
            },
            "details": {
                "location": "England, GB",
                "previous_ip_address": "175.16.199.64",
                "reason": [
                    "asn",
                    "ip_address"
                ]
            },
            "entity": {
                "email": "jbob@example.com",
                "entity_type": "user",
                "id": "asdfasdf",
                "name": "Joe Bob",
                "team": "T234SAH2"
            }
        }
    },
    "source": {
        "address": "81.2.69.143",
        "geo": {
            "city_name": "London",
            "continent_name": "Europe",
            "country_iso_code": "GB",
            "country_name": "United Kingdom",
            "location": {
                "lat": 51.5142,
                "lon": -0.0931
            },
            "region_iso_code": "GB-ENG",
            "region_name": "England"
        },
        "ip": "81.2.69.143"
    },
    "tags": [
        "forwarded",
        "slack-audit",
        "preserve_original_event"
    ],
    "user": {
        "email": "aaron@example.com",
        "full_name": "roy",
        "id": "e65b0f5c"
    },
    "user_agent": {
        "device": {
            "name": "Other"
        },
        "name": "Firefox",
        "original": "Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:23.0) Gecko/20131011 Firefox/23.0",
        "os": {
            "full": "Windows 7",
            "name": "Windows",
            "version": "7"
        },
        "version": "23.0"
    }
}
Changelog
Version Details Minimum Kibana version
1.33.0 Enhancement (View pull request)
Update Elastic Managed integration documentation to the current wording and docs links.		 9.1.4
9.0.7
8.19.4
1.32.2 Bug fix (View pull request)
Fix documents rejected when Slack MCP server tool call arguments in details.arguments change shape between events, and declare details.tool.		 9.1.4
9.0.7
8.19.4
1.32.1 Bug fix (View pull request)
Fix handling of empty value for details.previous_ip_address field.		 9.1.4
9.0.7
8.19.4
1.32.0 Enhancement (View pull request)
Enable request trace log removal.		 9.1.4
9.0.7
8.19.4
1.31.0 Enhancement (View pull request)
Add tags to ingest pipeline processors and add preserve_original_event to pipeline-level on_failure handlers.		 9.1.4
9.0.7
8.19.4
1.30.1 Enhancement (View pull request)
Set agentless deployment mode release field to ga.		 9.1.4
9.0.7
8.19.4
1.30.0 Enhancement (View pull request)
Set 'elastic' owner type.		 9.1.4
9.0.7
8.19.4
1.29.0 Enhancement (View pull request)
Reorganize variable to hide advanced variables and make agentless the default deployment mode.		 9.1.4
9.0.7
8.19.4
1.28.0 Enhancement (View pull request)
Use new release field for agentless deployment mode to establish as beta.		 9.1.4
9.0.7
8.19.4
1.27.0 Enhancement (View pull request)
Enable Agentless deployment.		 9.1.4
9.0.7
8.19.4
1.26.0 Enhancement (View pull request)
Prevent updating fleet health status to degraded when the next_cursor is not present.		 9.1.4
9.0.7
8.19.4
1.25.1 Bug fix (View pull request)
Fix handling of empty Slack context.ip_address fields.		 9.0.0
8.13.0
1.25.0 Enhancement (View pull request)
Update Kibana constraint to support 9.0.0.		 9.0.0
8.13.0
1.24.1 Bug fix (View pull request)
Updated SSL description in package manifest.yml to be uniform and to include links to documentation.		 8.13.0
1.24.0 Enhancement (View pull request)
Do not remove event.original in main ingest pipeline.		 8.13.0
1.23.0 Enhancement (View pull request)
Add "preserve_original_event" tag to documents with event.kind set to "pipeline_error".		 8.13.0
1.22.0 Enhancement (View pull request)
Map details.url_private and actor fields.

Enhancement (View pull request)
Improve pipeline efficiency.		 8.13.0
1.21.2 Bug fix (View pull request)
Use triple-brace Mustache templating when referencing variables in ingest pipelines.		 8.13.0
1.21.1 Bug fix (View pull request)
Use triple-brace Mustache templating when referencing variables in ingest pipelines.		 8.13.0
1.21.0 Enhancement (View pull request)
Update the kibana constraint to ^8.13.0. Modified the field definitions to remove ECS fields made redundant by the ecs@mappings component template.		 8.13.0
1.20.0 Enhancement (View pull request)
Improve handling of empty responses.		 8.12.0
1.19.0 Enhancement (View pull request)
Map md5 hash detail for files.		 8.12.0
1.18.0 Enhancement (View pull request)
Set sensitive values as secret.		 8.12.0
1.17.1 Enhancement (View pull request)
Changed owners		 8.10.1
1.17.0 Enhancement (View pull request)
Limit request tracer log count to five.		 8.10.1
1.16.0 Enhancement (View pull request)
ECS version updated to 8.11.0.		 8.10.1
1.15.1 Bug fix (View pull request)
Choose the correct value for the oldest param.		 8.10.1
1.15.0 Enhancement (View pull request)
Improve 'event.original' check to avoid errors if set.		 8.7.1
1.14.1 Bug fix (View pull request)
Keep oldest parameter when paginating responses.		 8.7.1
1.14.0 Enhancement (View pull request)
Set 'community' owner type.		 8.7.1
1.13.0 Enhancement (View pull request)
Update the package format_version to 3.0.0.		 8.7.1
1.12.0 Enhancement (View pull request)
Update package to ECS 8.10.0 and align ECS categorization fields.		 8.7.1
1.11.0 Enhancement (View pull request)
Add tags.yml file so that integration's dashboards and saved searches are tagged with "Security Solution" and displayed in the Security Solution UI.		 8.7.1
1.10.1 Bug fix (View pull request)
Fix handling of API query param 'oldest'		 8.7.1
1.10.0 Enhancement (View pull request)
Update package-spec to 2.9.0.		 8.7.1
1.9.0 Enhancement (View pull request)
Update package to ECS 8.9.0.		 8.7.1
1.8.0 Enhancement (View pull request)
Document duration units.		 8.7.1
1.7.1 Bug fix (View pull request)
Parse action_timestamp values as microseconds since unix epoch.		 8.7.1
1.7.0 Enhancement (View pull request)
Document valid duration units.		 8.7.1
1.6.0 Enhancement (View pull request)
Ensure error.message is correctly set for pipeline errors.		 8.7.1
1.5.0 Enhancement (View pull request)
Update package to ECS 8.8.0.		 8.7.1
1.4.0 Enhancement (View pull request)
Adds anomaly detail fields.

Bug fix (View pull request)
Fix formatting of 'oldest' API query parameter.		 8.7.1
1.3.0 Enhancement (View pull request)
Add slack.audit.context.session_id field.		 8.7.1
1.2.0 Enhancement (View pull request)
Add a new flag to enable request tracing		 8.7.1
1.1.0 Enhancement (View pull request)
Update package to ECS 8.7.0.		 8.1.0
1.0.0 Enhancement (View pull request)
Release Slack as GA.		 8.1.0
0.3.0 Enhancement (View pull request)
Update package to ECS 8.6.0.		 8.1.0
0.2.1 Bug fix (View pull request)
Remove duplicate fields.		 8.1.0
0.2.0 Enhancement (View pull request)
Update package to ECS 8.5.0.		 8.1.0
0.1.2 Bug fix (View pull request)
Remove duplicate field.		 8.1.0
0.1.1 Enhancement (View pull request)
Use ECS geo.location definition.		 8.1.0
0.1.0 Enhancement (View pull request)
Initial draft of the package		 8.1.0