Slack Integration

Receive real-time detection alerts in your Slack channels to keep your security team informed.

Prerequisites

• A Slack workspace
• Permission to create apps or incoming webhooks
• A channel for alerts

Setting Up Slack Webhook

Option 1: Incoming Webhook (Simplest)

1. Go to Slack API: Incoming Webhooks
2. Click Create your Slack app
3. Choose From scratch
4. Name your app (e.g., “WebDecoy Alerts”)
5. Select your workspace
6. Go to Incoming Webhooks in the sidebar
7. Toggle Activate Incoming Webhooks to On
8. Click Add New Webhook to Workspace
9. Select the channel for alerts
10. Copy the webhook URL

WebDecoy sends via incoming webhooks only — the URL must be a hooks.slack.com webhook. Bot-token Slack apps aren’t supported.

Configuring in WebDecoy

1. Go to Integrations → Slack

2. Click Add Slack Integration

3. Enter:

   Field	Description
   Name	Integration name (e.g., “Security Alerts”)
   Webhook URL	Slack webhook URL
   Channel	Target channel name (for display only)

4. Configure notifications:

   Setting	Description
   Alert on all detections	Every detection
   Alert on high risk only	Score >= 80
   Alert on blocks	When IPs are blocked

5. Click Create

Notification Settings

Alert Levels

Level	Score Range	Default Notification
MINIMAL	0-19	No alert
LOW	20-39	No alert
MEDIUM	40-59	Optional
HIGH	60-79	Optional (high-risk alerts fire at 80+)
CRITICAL	80-100	Yes

Recommended Settings

For active monitoring:

• Alert on high risk only (reduces noise)
• Enable block notifications

For high-security environments:

• Alert on all detections
• Enable all notification types

Slack Message Format

Detection Alert

🚨 WebDecoy Alert

Threat Detected: Decoy Link Triggered

• IP: 192.168.1.100
• Score: 85 (CRITICAL)
• Location: New York, US · AS12345 Example ISP
• Risk flags: VPN · Hosting
• Reverse DNS: host.example.net
• Threat intel: abuse score 97
• TLS fingerprint (JA4): t13d1516h2_8daaf6152771_b0da82dd1658

View Full Detection Details →

Alerts are rich Slack blocks including the IP’s ASN, risk flags (VPN/Proxy/Tor/Hosting), reverse DNS, threat-intel abuse score, and the JA4 TLS fingerprint, plus a link to the full detection. When a response action enforces against the detection, a status line is appended to the same message.

Multiple Channels

You can create multiple Slack integrations for different purposes:

Integration	Channel	Settings
Security Alerts	#security-alerts	High risk only
All Detections	#webdecoy-all	All detections
Blocks	#ip-blocks	Block notifications only

Message Components

Component	Included
Threat level emoji	✅
IP address	✅
Threat score & level	✅
Detection source	✅
GeoIP location + ASN	✅
Risk flags (VPN/Proxy/Tor/Hosting)	✅
Reverse DNS	✅
Threat-intel abuse score	✅
JA4 TLS fingerprint	✅
Link to full detection	✅

Messages are informational — there are no interactive action buttons. To act on a detection (deny the actor, arm a WAF rule), follow the link into the dashboard.

Managing Alert Volume

Use the per-integration triggers (high-risk-only is the recommended default) and channel routing to control volume — WebDecoy does not deduplicate or throttle Slack messages itself.

Best Practices

Do’s

• ✅ Use a dedicated channel for alerts
• ✅ Start with “high risk only” and adjust
• ✅ Set up multiple integrations for different alert levels
• ✅ Include relevant team members in the channel
• ✅ Configure channel notifications appropriately

Don’ts

• ❌ Send all detections to a busy channel
• ❌ Ignore alert fatigue (reduce noise)
• ❌ Use a personal DM (use a channel)
• ❌ Forget to test the integration

Troubleshooting

Messages Not Appearing

1. Verify webhook URL is correct
2. Check integration is enabled in WebDecoy
3. Verify channel exists and app has access
4. Test with WebDecoy’s test button
5. Check Slack app permissions

”channel_not_found” Error

1. Ensure the app is in the channel
2. For private channels, invite the app first
3. Verify channel name is spelled correctly

Rate Limited

1. Check Slack API rate limits
2. Reduce notification frequency
3. Use “high risk only” setting
4. Consider batching alerts

---

Next Steps

• Cloudflare - Automatic IP blocking
• Webhooks - Custom event processing
• Overview - All integrations