Skip to content
WebDecoy Docs

Slack Integration

Receive real-time detection alerts in your Slack channels to keep your security team informed.

Prerequisites

Section titled “Prerequisites”
  • A Slack workspace
  • Permission to create apps or incoming webhooks
  • A channel for alerts

Setting Up Slack Webhook

Section titled “Setting Up Slack Webhook”

Option 1: Incoming Webhook (Simplest)

Section titled “Option 1: Incoming Webhook (Simplest)”
  1. Go to Slack API: Incoming Webhooks
  2. Click Create your Slack app
  3. Choose From scratch
  4. Name your app (e.g., “WebDecoy Alerts”)
  5. Select your workspace
  6. Go to Incoming Webhooks in the sidebar
  7. Toggle Activate Incoming Webhooks to On
  8. Click Add New Webhook to Workspace
  9. Select the channel for alerts
  10. Copy the webhook URL

Option 2: Slack App (More Control)

Section titled “Option 2: Slack App (More Control)”
  1. Go to Slack API
  2. Click Create New App
  3. Choose From scratch
  4. Name it “WebDecoy” and select workspace
  5. Go to OAuth & Permissions
  6. Add scopes:
    • chat:write
    • chat:write.public (optional, for any channel)
  7. Install to workspace
  8. Copy the Bot User OAuth Token

Configuring in WebDecoy

Section titled “Configuring in WebDecoy”

  1. Go to Integrations → Slack

  2. Click Add Slack Integration

  3. Enter:

    FieldDescription
    NameIntegration name (e.g., “Security Alerts”)
    Webhook URLSlack webhook URL
    ChannelTarget channel name (for display only)

  4. Configure notifications:

    SettingDescription
    Alert on all detectionsEvery detection
    Alert on high risk onlyScore >= 70
    Alert on blocksWhen IPs are blocked

  5. Click Create

Notification Settings

Section titled “Notification Settings”

Alert Levels

Section titled “Alert Levels”
LevelScore RangeDefault Notification
MINIMAL0-20No alert
LOW21-40No alert
MEDIUM41-60Optional
HIGH61-80Yes
CRITICAL81-100Yes
Section titled “Recommended Settings”

For active monitoring:

  • Alert on high risk only (reduces noise)
  • Enable block notifications

For high-security environments:

  • Alert on all detections
  • Enable all notification types

Slack Message Format

Section titled “Slack Message Format”

Detection Alert

Section titled “Detection Alert”
🚨 WebDecoy Alert


Threat Detected: Decoy Link Triggered


• IP: 192.168.1.100
• Score: 85 (CRITICAL)
• Source: Admin Backup Trap
• Path: /admin/backup.zip
• Location: New York, US
• MITRE: Reconnaissance (TA0043)
• Bot Score: 92%


[View Detection] [Block IP]

Block Notification

Section titled “Block Notification”
🛡️ IP Blocked


An IP has been blocked by Cloudflare integration.


• IP: 192.168.1.100
• Reason: High-risk detection
• Duration: 24 hours
• Detection: det_abc123


[View Details] [Unblock]

Multiple Channels

Section titled “Multiple Channels”

You can create multiple Slack integrations for different purposes:

IntegrationChannelSettings
Security Alerts#security-alertsHigh risk only
All Detections#webdecoy-allAll detections
Blocks#ip-blocksBlock notifications only

Interactive Messages

Section titled “Interactive Messages”

Slack messages include action buttons:

View Detection

Section titled “View Detection”

Opens the detection details in WebDecoy dashboard.

Block IP

Section titled “Block IP”

Quickly block an IP without leaving Slack:

  1. Click Block IP
  2. Select duration (1h, 24h, 7d, 30d)
  3. IP is blocked via Cloudflare integration

Note: Block IP button requires Cloudflare integration to be configured.

Customizing Messages

Section titled “Customizing Messages”

Message Components

Section titled “Message Components”
ComponentIncluded
Threat level emoji✅
IP address✅
Threat score✅
Detection source✅
Request path✅
GeoIP location✅
MITRE tactic✅
Bot score✅
Action buttons✅

Rate Limiting

Section titled “Rate Limiting”

To prevent alert fatigue, WebDecoy implements:

  • Deduplication: Same IP won’t trigger multiple alerts within 5 minutes
  • Batching: High-volume periods may batch alerts
  • Throttling: Max 60 messages per minute per integration

Best Practices

Section titled “Best Practices”

Do’s

Section titled “Do’s”
  • ✅ Use a dedicated channel for alerts
  • ✅ Start with “high risk only” and adjust
  • ✅ Set up multiple integrations for different alert levels
  • ✅ Include relevant team members in the channel
  • ✅ Configure channel notifications appropriately

Don’ts

Section titled “Don’ts”
  • ❌ Send all detections to a busy channel
  • ❌ Ignore alert fatigue (reduce noise)
  • ❌ Use a personal DM (use a channel)
  • ❌ Forget to test the integration

Troubleshooting

Section titled “Troubleshooting”

Messages Not Appearing

Section titled “Messages Not Appearing”
  1. Verify webhook URL is correct
  2. Check integration is enabled in WebDecoy
  3. Verify channel exists and app has access
  4. Test with WebDecoy’s test button
  5. Check Slack app permissions

”channel_not_found” Error

Section titled “”channel_not_found” Error”
  1. Ensure the app is in the channel
  2. For private channels, invite the app first
  3. Verify channel name is spelled correctly

Rate Limited

Section titled “Rate Limited”
  1. Check Slack API rate limits
  2. Reduce notification frequency
  3. Use “high risk only” setting
  4. Consider batching alerts

Buttons Not Working

Section titled “Buttons Not Working”
  1. Ensure you’re logged into WebDecoy
  2. Check browser allows popups
  3. Verify WebDecoy session is active

Next Steps

Section titled “Next Steps”