Slack Chatbot Integration

How to connect Guard to Slack so your team can receive security findings and interact with Guard directly from Slack channels.

Guard's Slack integration brings security findings, hunt activity, and workflows into the Slack channels your team already uses for incident response and collaboration. Once connected, Guard can receive @mentions, post threaded replies, and link Slack conversations to Guard identities — without requiring a context switch to the Guard platform.

Prerequisites

  • A Slack workspace where you have permission to install apps.
  • Guard organization admin rights to configure integrations.

Connect Guard to Slack

  1. In Guard, navigate to Integrations > Collaboration > Slack.
  2. Select Connect.
  3. Complete the Slack OAuth flow to authorize Guard in your workspace. Guard uses a KMS-secured state token during this exchange to prevent request forgery.
  4. Once authorized, Guard confirms the connection and begins listening for @mentions in channels where the Guard app is present.

Invite Guard to a channel

After the app is installed in your workspace, invite the Guard bot to any channel where you want it to respond:

/invite @Guard

Guard will post threaded replies in that channel, keeping conversations organized and in context.

How it works

Capability

Detail

Mention handling

@mention Guard in any channel it has been invited to; Guard parses the request and responds in-thread.

Threaded replies

Responses are always posted as thread replies, so channel noise is minimized.

User identity linking

Guard maps your Slack user identity to your Guard account, so activity is attributed correctly.

Thread tracking

Ongoing conversations are tracked per thread, preserving context across multiple exchanges.

Platform support

The Slack integration is built on a platform-neutral adapter architecture. A Microsoft Teams adapter is planned and will follow without changes to Guard's core chatbot logic. Configuration steps for Teams will be documented when that adapter ships.

Disconnect the integration

  1. Navigate to Integrations > Collaboration > Slack.
  2. Select Disconnect.
  3. Remove the Guard app from your Slack workspace via Slack > Settings > Manage apps if you also want to revoke workspace-level authorization.

Troubleshooting

Guard does not respond to mentions Confirm the Guard app has been invited to the channel with /invite @Guard. The bot only listens in channels it has been explicitly added to.

OAuth flow fails or shows an error Ensure you have permission to install apps in your Slack workspace. If your workspace enforces an app allowlist, an admin must approve the Guard app before the OAuth flow can complete.

User identity is not linked Each Slack user must complete the identity-linking step the first time they interact with Guard in Slack. If prompted, follow the in-thread link to associate your Slack account with your Guard identity.