Slack

Subscribe
Download 0
Last updated Aug 2, 2026

Rules

Download all rules

Official 5 Proposals 0

Slack App Installed

Detect Slack app installation events in Slack audit logs.

Stream Priority Medium slack-audit T1671

Slack App Scopes Expanded

Detect Slack app scope expansion events in Slack audit logs.

Stream Priority Low slack-audit T1550.001

Slack Login From New Location

Detect Slack login events from IP addresses with no history over the past 6 months in Slack audit logs.

Stream Priority Low slack-audit T1078.004

Slack Owner Role Granted To User

Detects Slack owner role change events in Slack audit logs.

Stream Priority Medium slack-audit T1098

Slack Owner Transferred

Detect Slack workspace owner transfer events in Slack audit logs.

Stream Priority Medium slack-audit T1098