Skip to content
WebDecoy Docs

Slack Integration

Receive real-time detection alerts in your Slack channels to keep your security team informed.

Prerequisites

Section titled “Prerequisites”
  • A Slack workspace
  • Permission to create apps or incoming webhooks
  • A channel for alerts

Setting Up Slack Webhook

Section titled “Setting Up Slack Webhook”

Option 1: Incoming Webhook (Simplest)

Section titled “Option 1: Incoming Webhook (Simplest)”
  1. Go to Slack API: Incoming Webhooks
  2. Click Create your Slack app
  3. Choose From scratch
  4. Name your app (e.g., “WebDecoy Alerts”)
  5. Select your workspace
  6. Go to Incoming Webhooks in the sidebar
  7. Toggle Activate Incoming Webhooks to On
  8. Click Add New Webhook to Workspace
  9. Select the channel for alerts
  10. Copy the webhook URL

WebDecoy sends via incoming webhooks only: the URL must be a hooks.slack.com webhook. Bot-token Slack apps aren’t supported.

Configuring in WebDecoy

Section titled “Configuring in WebDecoy”

  1. Go to Integrations → Slack

  2. Click Add Slack Integration

  3. Enter:

    Field Description
    Name Integration name (e.g., “Security Alerts”)
    Slack Webhook URL Slack incoming webhook URL (hooks.slack.com)
    Channel Override (optional) Sent as channel with each message. Slack apps’ incoming webhooks normally post to the channel chosen when the webhook was created

  4. Configure notifications:

    Setting Description
    All Detections Every detection
    High Risk Detections (Score ≥ 80) Detections whose bot_score is 80 or higher
    Rule Enforced Events Detections where a response action enforced
    Minimum Score (optional) Skip detections below this unified score
    Filter by Decoys (optional) Only alert for the selected decoys

  5. Click Create Integration, then use Test on the integration card

Notification Settings

Section titled “Notification Settings”
Section titled “Recommended Settings”

For active monitoring:

  • High Risk Detections only (reduces noise)
  • Rule Enforced Events

For high-security environments:

  • Alert on all detections
  • Enable all notification types

Slack Message Format

Section titled “Slack Message Format”

Detection Alert

Section titled “Detection Alert”

Illustrative example of the text content (Slack renders these as blocks):

⚠️ New Detection


Bot Score: 92            IP Address: 198.51.100.23
Timestamp: Jul 15, 10:30:00 UTC    Detection ID: 5d0c8f1e
Request: GET /wp-admin/backup.zip  Domain: example.com
Location: New York, United States  ASN: AS12345 Example ISP
Risk Flags: VPN  Hosting
Reverse DNS: host.example.net
Threat Intel: Abuse Score: 97% | Reports: 12
TLS Version: TLS 1.3     Fingerprint: t13d1516h2_8daaf6152771
User Agent: Mozilla/5.0 ...


🔍 View Full Detection Details
WebDecoy | Source: Decoy Link | Decoy: c2e9f6a0

The header is New Detection, High Risk Detection (bot_score 80 or higher) or Rule Enforced. Sections appear only when the data exists: request and domain, GeoIP location and ASN, risk flags (VPN, Proxy, Tor, Hosting, Anonymous), reverse DNS (with the crawler name when it matches a known bot), threat intel (AbuseIPDB score and report count, or ISP when there are no reports), TLS fingerprint (JA4, or JA3 when no JA4), and referer. A Rule Enforced message adds an enforcement status line.

Multiple Channels

Section titled “Multiple Channels”

You can create multiple Slack integrations for different purposes:

Integration Channel Settings
Security Alerts #security-alerts High risk only
All Detections #webdecoy-all All detections
Blocks #ip-blocks Block notifications only

Message Components

Section titled “Message Components”
Component Included
Event emoji and title ✅
IP address ✅
Bot score ✅
Detection source and decoy ✅
Request method, path and domain ✅
GeoIP location + ASN ✅
Risk flags (VPN/Proxy/Tor/Hosting) ✅
Reverse DNS ✅
Threat-intel abuse score ✅
TLS fingerprint (JA4 or JA3) ✅
User agent and referer ✅
Link to full detection ✅

Messages are informational. There are no interactive action buttons. To act on a detection (deny the actor, arm a WAF rule), follow the link into the dashboard.

Managing Alert Volume

Section titled “Managing Alert Volume”

Use the per-integration triggers, the minimum score, and channel routing to control volume. WebDecoy does not deduplicate or throttle Slack messages itself.

Best Practices

Section titled “Best Practices”

Do’s

Section titled “Do’s”
  • ✅ Use a dedicated channel for alerts
  • ✅ Start with “high risk only” and adjust
  • ✅ Set up multiple integrations for different alert levels
  • ✅ Include relevant team members in the channel
  • ✅ Configure channel notifications appropriately

Don’ts

Section titled “Don’ts”
  • ❌ Send all detections to a busy channel
  • ❌ Ignore alert fatigue (reduce noise)
  • ❌ Use a personal DM (use a channel)
  • ❌ Forget to test the integration

Troubleshooting

Section titled “Troubleshooting”

Messages Not Appearing

Section titled “Messages Not Appearing”
  1. Verify webhook URL is correct
  2. Check integration is enabled in WebDecoy
  3. Verify the channel the webhook was created for still exists
  4. Test with WebDecoy’s test button
  5. Check the integration card’s last error
  6. On a WordPress-plugin account, Slack alerts require a plan that includes alerts

“channel_not_found” Error

Section titled ““channel_not_found” Error”
  1. Ensure the app is in the channel
  2. For private channels, invite the app first
  3. Verify channel name is spelled correctly

Rate Limited

Section titled “Rate Limited”

WebDecoy sends one message per matching detection and does not batch or throttle.

  1. Check Slack’s rate limits for incoming webhooks
  2. Use High Risk Detections or a Minimum Score
  3. Split alerts across several webhooks and channels

Next Steps

Section titled “Next Steps”