Ctrlk
Go to Workbench
For the complete documentation index, see llms.txt. This page is also available as Markdown.

Manage Threaded Notifications in Slack or Teams

This option is only available for two-way, or bidirectional, notifications in Slack or Microsoft Teams specifically when Investigations or Incidents are created in Workbench.

If you are looking for organization-level notifications that are sent to an integration or plug-in, see Manage Organization Notifications. If you are looking for email notifications, see Manage Email Notifications.

Workbench can integrate with Slack or Microsoft Teams to allow for two-way messaging with our SOC Analysts. You can thread your replies directly onto the Slack or Teams "Investigation Created" and "Incident Created" notifications, and responses from Workbench will flow back into your Slack or Microsoft Teams thread, creating a seamless conversation loop.

Prerequisites

  1. You must have already set up the Slack or Microsoft Teams platforms so that they can receive organization notifications in Workbench.

  2. You must have a valid email address in your Slack or Teams profile.

  3. You must have the Comment Created organization notification turned on for Slack or Microsoft Teams.

  4. You must have either (or both) of the Incident Created and Investigation Created organization notifications turned on for Slack or Microsoft Teams.

For help turning on the necessary organization notifications, see Manage Organization Notifications.

Bidirectional Notifications via Slack

  1. Add a comment to an existing Incident Created or Investigation Created thread in Slack. You may also include images. Ruxie (our automated response bot) acknowledges the message is received.

  2. The comment appears on the Incident or Investigation in Workbench and the SOC is notified, with no support ticket or Workbench login required.

    Image showing an example Slack thread.

  1. Add a comment to an Incident or Investigation in Workbench and the SOC is notified without the need to create a ticket.

  2. The comment appears in a thread under the Incident Created or Investigation Created notification in Slack. Further communication for this Incident or Investigation will occur in this thread.

Image showing an example Workbench and Ruxie thread.

Bidirectional Notifications via Microsoft Teams

  1. Add a comment to an existing Incident Created or Investigation Created thread in Teams. You may also include images. Ruxie (our automated response bot) acknowledges the message is received.

  2. The comment appears on the Incident or Investigation in Workbench and the SOC is notified, with no support ticket or Workbench login required.

Image showing an example thread.

  1. Add a comment to an Incident or Investigation in Workbench and the SOC is notified without the need to create a ticket.

  2. The comment appears in a thread under the Incident Created or Investigation Created notification in Teams. Further communication for this Incident or Investigation will occur in this thread.

Image showing an example Workbench and Ruxie thread.

Last updated

Was this helpful?