Slack – Marcus Chat Integration
Connect Guard's Marcus Slack app to receive rich Block Kit notifications and run identity-verified queries and actions directly from Slack channels.
Slack – Marcus Chat Integration
Marcus is Guard's Slack app. It replaces the earlier one-way webhook integration with a full multi-tenant OAuth install that delivers structured Block Kit notifications through a bot token and ties every Slack interaction to a verified Guard identity. Actions and queries made from Slack execute with the requesting user's Guard role and permissions applied.
Prerequisites
- A Slack workspace where you have permission to install apps.
- A Guard account with the Integrations permission (required to complete the OAuth install).
How it works
Install the Marcus Slack app
The integration uses a standard OAuth install flow. No manual token configuration is required.
- In Guard, navigate to Integrations > Notifications > Slack (Chat Bot).
- Click Add to Slack.
- Complete the Slack OAuth v2 authorization prompt. You will be asked to grant Marcus the permissions it needs to post to channels.
- After authorization, you are returned to Guard to complete channel binding (see below).
Bind a Slack channel to your tenant
After the OAuth flow completes, bind at least one Slack channel to your Guard tenant before Guard can deliver messages.
- Select the Slack channel you want to receive Guard messages.
- Review the confirmation prompt, which shows the channel name and the tenant it will be mapped to.
- Confirm the binding to establish the connection.
Repeat this process for each additional channel you want to bind.
Note: The Guard app must be a member of the target channel. If a channel does not appear in the binding list, run
/invite @Guardin that channel in Slack and then return to the binding step.
Link your Guard identity
Every Slack user who wants to run queries or actions through Marcus must complete a one-time account linking step. This binds their Slack identity to their Guard user and ensures that all interactions execute with the correct Guard permissions.
- In the connected Slack channel, follow the Connect your Guard account prompt sent by the Marcus app, or initiate linking from your Guard profile settings.
- Authorize the connection between your Slack user and your Guard account.
Once linked, Marcus applies your Guard role and RBAC to all queries and actions you initiate from Slack.
Revoking an account link
An account link can be revoked at any time from either surface:
- From Guard: Open your profile settings, locate the Slack identity binding, and remove it.
- From Slack: Use the Marcus app's account management options to disconnect your Guard account.
Revoking a binding is immediate and affects only the individual user. Other users' bindings and the workspace-level OAuth install remain intact.
Manage connected channels
You can view and manage all channels connected to your tenant from the Integrations page.
- Navigate to Integrations > Notifications > Slack (Chat Bot).
- The connected channels list shows each channel with its associated tenant mapping.
- To disconnect a channel, click the disconnect control on that row and confirm when prompted.
Disconnecting a channel stops Guard from delivering messages to it. The OAuth app authorization remains in place; you can re-bind channels at any time without repeating the OAuth flow.
Notifications delivered by Marcus
Marcus sends the following notification types as Block Kit messages:
- Risk transitions — when a finding's risk level changes.
- Exposure alerts — when new exposures are identified for your assets.
- Emergent-threat notifications — when Guard detects a newly active threat relevant to your attack surface.
Each message includes structured fields and status labels (Detected, Demonstrated, Resolved, Accepted, Rejected) that match what is shown in the Guard UI.