Connect Slack

Before you start

You need the Slack workspace administrator admin rights described below, and in Trusterio the right to manage integrations (owners and admins have it). Anybody else sees the page read-only.

Connect it

1. Open Automation and choose Connect on the Slack workspace administrator card. (The link opens the dialog straight away.)
2. Give it a name under What to call it, and read What to grant: every permission and what it is for.
3. Press Add it and enter the credential. You land on the connection’s own page.

In Slack

1. Create a Slack app from scratch, with the bot scope chat:write. Add chat:write.public only if you would rather not invite the bot to each channel.
2. Install the app in your workspace and copy its Bot User OAuth Token (it starts with xoxb-). If your workspace requires app approval, or is part of an Enterprise Grid org, an owner or admin approves the install first.
3. Invite the bot to the channels it should post in. A private channel always needs the invite, even with chat:write.public.

In Trusterio

1. Paste the Bot token and press Save credentials.
2. Under Channels, add each channel: its Channel ID (C0123…), a name for you, and Post when severity is: critical only, warning and above, or everything.
3. Choose What the channel is told. By default, the severity, how many people were told, and a link; nothing more. To include the subject line, you write down why that channel may see it, and the channel is marked as disclosing subjects.

What it posts

Each notice your business raises at or above a channel’s severity, such as a control that drifted or went stale, evidence about to expire, a leaver who still has access, or a connection that lost its access. It is posted within a minute or so. Trusterio has no permission to read your channels or messages.

After it is connected

• Press Sync now for the first reading. The Tests tab shows each check: what it should be, what was found, and what is affected.
• New connections are read by hand until you choose a schedule: in Monitoring, on the Collection tab, pick Every hour, Every 6 hours, Daily or Weekly.
• The page says when it was last read and its health; Sync History keeps every run.

A connection marked Beta on the Automation screen has not been tried on a real account yet: its permission list is our reading of the provider’s documentation. AWS, Azure, Google Cloud and Jira have been. If a permission is wrong, tell us.

Disconnect

On the connection’s page, choose Disconnect. Reading stops and its credentials are deleted; its history, checks and evidence stay. Then remove what you created at the provider:

• Uninstall the app from your Slack workspace, or revoke its token.