Skip to content
WebDecoy Docs

Slack Integration

Receive real-time detection alerts in your Slack channels to keep your security team informed.

Prerequisites

Section titled “Prerequisites”
  • A Slack workspace
  • Permission to create apps or incoming webhooks
  • A channel for alerts

Setting Up Slack Webhook

Section titled “Setting Up Slack Webhook”

Option 1: Incoming Webhook (Simplest)

Section titled “Option 1: Incoming Webhook (Simplest)”
  1. Go to Slack API: Incoming Webhooks
  2. Click Create your Slack app
  3. Choose From scratch
  4. Name your app (e.g., “WebDecoy Alerts”)
  5. Select your workspace
  6. Go to Incoming Webhooks in the sidebar
  7. Toggle Activate Incoming Webhooks to On
  8. Click Add New Webhook to Workspace
  9. Select the channel for alerts
  10. Copy the webhook URL

WebDecoy sends via incoming webhooks only: the URL must be a hooks.slack.com webhook. Bot-token Slack apps aren’t supported.

Configuring in WebDecoy

Section titled “Configuring in WebDecoy”

  1. Go to Integrations → Slack

  2. Click Add Slack Integration

  3. Enter:

    Field Description
    Name Integration name (e.g., “Security Alerts”)
    Webhook URL Slack webhook URL
    Channel Target channel name (for display only)

  4. Configure notifications:

    Setting Description
    Alert on all detections Every detection
    Alert on high risk only Score >= 80
    Alert on blocks When IPs are blocked

  5. Click Create

Notification Settings

Section titled “Notification Settings”

Alert Levels

Section titled “Alert Levels”
Level Score Range Default Notification
MINIMAL 0-19 No alert
LOW 20-39 No alert
MEDIUM 40-59 Optional
HIGH 60-79 Optional (high-risk alerts fire at 80+)
CRITICAL 80-100 Yes
Section titled “Recommended Settings”

For active monitoring:

  • Alert on high risk only (reduces noise)
  • Enable block notifications

For high-security environments:

  • Alert on all detections
  • Enable all notification types

Slack Message Format

Section titled “Slack Message Format”

Detection Alert

Section titled “Detection Alert”
🚨 WebDecoy Alert


Threat Detected: Decoy Link Triggered


• IP: 192.168.1.100
• Score: 85 (CRITICAL)
• Location: New York, US · AS12345 Example ISP
• Risk flags: VPN · Hosting
• Reverse DNS: host.example.net
• Threat intel: abuse score 97
• TLS fingerprint (JA4): t13d1516h2_8daaf6152771_b0da82dd1658


View Full Detection Details →

Alerts are rich Slack blocks including the IP’s ASN, risk flags (VPN/Proxy/Tor/Hosting), reverse DNS, threat-intel abuse score, and the JA4 TLS fingerprint, plus a link to the full detection. When a response action enforces against the detection, a status line is appended to the same message.

Multiple Channels

Section titled “Multiple Channels”

You can create multiple Slack integrations for different purposes:

Integration Channel Settings
Security Alerts #security-alerts High risk only
All Detections #webdecoy-all All detections
Blocks #ip-blocks Block notifications only

Message Components

Section titled “Message Components”
Component Included
Threat level emoji ✅
IP address ✅
Threat score & level ✅
Detection source ✅
GeoIP location + ASN ✅
Risk flags (VPN/Proxy/Tor/Hosting) ✅
Reverse DNS ✅
Threat-intel abuse score ✅
JA4 TLS fingerprint ✅
Link to full detection ✅

Messages are informational. There are no interactive action buttons. To act on a detection (deny the actor, arm a WAF rule), follow the link into the dashboard.

Managing Alert Volume

Section titled “Managing Alert Volume”

Use the per-integration triggers (high-risk-only is the recommended default) and channel routing to control volume. WebDecoy does not deduplicate or throttle Slack messages itself.

Best Practices

Section titled “Best Practices”

Do’s

Section titled “Do’s”
  • ✅ Use a dedicated channel for alerts
  • ✅ Start with “high risk only” and adjust
  • ✅ Set up multiple integrations for different alert levels
  • ✅ Include relevant team members in the channel
  • ✅ Configure channel notifications appropriately

Don’ts

Section titled “Don’ts”
  • ❌ Send all detections to a busy channel
  • ❌ Ignore alert fatigue (reduce noise)
  • ❌ Use a personal DM (use a channel)
  • ❌ Forget to test the integration

Troubleshooting

Section titled “Troubleshooting”

Messages Not Appearing

Section titled “Messages Not Appearing”
  1. Verify webhook URL is correct
  2. Check integration is enabled in WebDecoy
  3. Verify channel exists and app has access
  4. Test with WebDecoy’s test button
  5. Check Slack app permissions

“channel_not_found” Error

Section titled ““channel_not_found” Error”
  1. Ensure the app is in the channel
  2. For private channels, invite the app first
  3. Verify channel name is spelled correctly

Rate Limited

Section titled “Rate Limited”
  1. Check Slack API rate limits
  2. Reduce notification frequency
  3. Use “high risk only” setting
  4. Consider batching alerts

Next Steps

Section titled “Next Steps”