> For the complete documentation index, see [llms.txt](https://docs.expel.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.expel.io/workbench-setup/notifications/manage-threaded-notifications-in-slack-or-teams.md).

# Manage Threaded Notifications in Slack or Teams

{% hint style="warning" %}
This option is only available for two-way, or bidirectional, notifications in Slack or Microsoft Teams specifically when **Investigations** or **Incidents** are created in Workbench.
{% endhint %}

*If you are looking for organization-level notifications that are sent to an integration or plug-in, see* [*Manage Organization Notifications*](/workbench-setup/notifications/manage-organization-notifications.md)*. If you are looking for email notifications, see* [*Manage Email Notifications*](/workbench-setup/notifications/manage-email-notifications.md)*.*

Workbench can integrate with Slack or Microsoft Teams to allow for two-way messaging with our SOC Analysts. You can thread your replies directly onto the Slack or Teams "Investigation Created" and "Incident Created" notifications, and responses from Workbench will flow back into your Slack or Microsoft Teams thread, creating a seamless conversation loop.

## Prerequisites

1. You must have already set up the [Slack or Microsoft Teams platforms](/workbench-setup/notifications/platform-setup.md) so that they can receive organization notifications in Workbench.
   * Our [Support team](/support/how-to-reach-us.md) can help you with this step.
2. You must have the **Comment Created** organization notification turned on for Slack or Microsoft Teams.
3. You must have either (or both) of the **Incident Created** and **Investigation Created** organization notifications turned on for Slack or Microsoft Teams. 

{% hint style="info" %}
For help turning on the necessary organization notifications, see [Manage Organization Notifications](/workbench-setup/notifications/manage-organization-notifications.md).
{% endhint %}

## Bidirectional Notifications via Slack

{% tabs %}
{% tab title="Slack to Workbench" %}

1. Add a comment to an existing **Incident Created** or **Investigation Created** thread in Slack. You may also include images. Ruxie (our automated response bot) acknowledges the message is received.
2. The comment appears on the Incident or Investigation in Workbench and the SOC is notified, with no support ticket or Workbench login required.<br>

   <figure><img src="/files/JggYY0vb1jwUn9pqWBwk" alt="Image showing an example Slack thread."><figcaption></figcaption></figure>

{% endtab %}

{% tab title="Workbench to Slack" %}

1. Add a comment to an Incident or Investigation in Workbench and the SOC is notified without the need to create a ticket.
2. The comment appears in a thread under the **Incident Created** or **Investigation Created** notification in Slack. Further communication for this Incident or Investigation will occur in this thread.

<figure><img src="/files/UxcqrZLT82sMUVRDSgtD" alt="Image showing an example Workbench and Ruxie thread."><figcaption></figcaption></figure>
{% endtab %}
{% endtabs %}

## Bidirectional Notifications via Microsoft Teams

{% tabs %}
{% tab title="Teams to Workbench" %}

1. Add a comment to an existing **Incident Created** or **Investigation Created** thread in Teams. You may also include images. Ruxie (our automated response bot) acknowledges the message is received.
2. The comment appears on the Incident or Investigation in Workbench and the SOC is notified, with no support ticket or Workbench login required.

<figure><img src="/files/AdN7xvbmIIQdemfnKBof" alt="Image showing an example thread."><figcaption></figcaption></figure>
{% endtab %}

{% tab title="Workbench to Teams" %}

1. Add a comment to an Incident or Investigation in Workbench and the SOC is notified without the need to create a ticket.
2. The comment appears in a thread under the **Incident Created** or **Investigation Created** notification in Teams. Further communication for this Incident or Investigation will occur in this thread.

<figure><img src="/files/pFhr58Mj5ADNXTIQKXOk" alt="Image showing an example Workbench and Ruxie thread."><figcaption></figcaption></figure>
{% endtab %}
{% endtabs %}


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.expel.io/workbench-setup/notifications/manage-threaded-notifications-in-slack-or-teams.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.