--- title: "Slack" slug: "slack" tags: ["Self Service Ingestion"] updated: 2026-02-28T21:34:40Z published: 2026-02-28T21:34:40Z canonical: "docs.hunters.ai/slack" --- > ## Documentation Index > Fetch the complete documentation index at: https://docs.hunters.ai/llms.txt > Use this file to discover all available pages before exploring further. # Slack Self Service Ingestion Connect this data source on your own, using the Hunters platform. ****TL;DR**** | Supported data types | 3rd party detection | Hunters detection | IOC search | Search | Table name | Log format | Collection method | | --- | --- | --- | --- | --- | --- | --- | --- | | Slack Audit Logs | | | โœ… | โœ… | slack_audit_logs | NDJSON | API | | Slack Users | | | | โœ… | slack_users | NDJSON | API | | Slack Files | | | | | slack_files | NDJSON | API | --- ## Overview ![image](https://cdn.document360.io/5f63f0e0-3c70-4d00-b623-82493be0bde5/Images/Documentation/image-1739188347902.png)[Slack](https://slack.com/) is a SaaS instant messaging program for professional and organizational communications, as well as a community platform. Integrating Slack into Hunters allows the collection and ingestion of key data types into the data lake. Furthermore, the data is mapped to the Hunters' detection engine and allows investigation and correlation to other related signals. ## Supported data types ๐Ÿ“˜Note For Slack Enterprise Organizations that have more than one workspace, Hunters currently support only Slack Audit Logs. ### Slack Audit Logs **Table name:** `slack_audit_logs` Slack Audit Logs are a crucial feature for administrators looking to monitor and audit actions within their Slack workspace. These logs provide a comprehensive record of operations performed by users and the system, including changes to workspace settings, user management activities, app installations, and access permissions modifications. Learn more [here](https://api.slack.com/admins/audit-logs). ### Slack Users **Table name:** `slack_users` Slack User Logs are detailed records of individual user activities within the Slack platform. These logs capture a wide array of actions, including messages sent, channels joined or left, files uploaded, and interactions with integrated apps. The purpose of maintaining such logs is multifold: they offer insights into user behavior, facilitate the monitoring of compliance with organizational policies, and assist in security audits by tracking potential unauthorized or suspicious activities. Learn more [here](https://api.slack.com/methods/users.list#examples). ### Slack Files **Table name:** `slack_files` Slack File Logs provide detailed information about file activities within the Slack environment. These logs track when users upload, download, share, or delete files, offering insights into how information is shared and managed across the platform. By maintaining a comprehensive record of file transactions, Slack File Logs are essential for data management, security, and compliance purposes. Learn more [here](https://api.slack.com/methods/files.list#examples). ## Send data to Hunters Hunters supports the collection of logs from Slack using API. **To connect Slack logs:** 1. Retrieve the API key by following these steps: 1. Log into your Slack Workspace with an Admin access. 2. Create a new Slack Application named "Hunters API Integration". Click [here](https://api.slack.com/apps) to learn more. 3. In the app settings, select **OAuth & Permissions** from the left navigation. 4. Scroll down to **Scopes > User Token Scopes** and then click **Add an OAuth Scope**. 5. Choose the relevant scopes with respect to the available plan and required data types (see breakdown below). 6. **Install** the application. ![image](https://cdn.document360.io/5f63f0e0-3c70-4d00-b623-82493be0bde5/Images/Documentation/e218ca1-image.png) After installation, a user API token will be automatically generated, in the following format:`xoxp-123456789123-987654321098-135791357913-a1b2c3d4e5f6a1b2c3d4e5f6a1b2c3d4e5f6`. The token will also appear under the **OAuth & Permissions** section. 2. Complete the process on the Hunters platform, following [this guide](https://hunters.document360.io/docs/connect-a-data-source). โš ๏ธ Attention - In case additional scopes are added to the same application in the future, a re-installation of the app is required, which results in a new token being generated. The old token needs to be replaced with the new one on the Hunters platform. - In the table below you can find the required scopes per data type. Data types that require an additional license are turned off by default in the Hunters UI. | Data Type | Required Scope | Additional License Required | | --- | --- | --- | | **Slack Audit Logs** | [auditlogs:read](https://api.slack.com/scopes/auditlogs:read) | Enterprise Grid | | **Slack Users** | [users:read](https://api.slack.com/scopes/users:read) | | | **Slack Files** | [files:read](https://api.slack.com/scopes/files:read) | | ## Expected format Logs are expected in JSON format. ### Slack Audit Logs Sample ```json {"id": "12341", "date_create": 1678949258, "action": "file_downloaded", "actor": {"type": "user", "user": {"id": "12343", "name": "Name A", "email": "user1@test.com", "team": "12345"}}, "entity": {"type": "file", "file": {"id": "12347", "name": "image.png", "filetype": "image/png", "title": "image.png"}}, "context": {"location": {"type": "workspace", "id": "123410", "name": "test.com", "domain": "test.com"}, "ua": "com.ts.ch/11,11,11.11 (iPhone; iOS 12.1.1; Scale/1.00)", "ip_address": "1.1.1.1", "session_id": 123413}, "details": {"url_private": "https://files.slack.com/files-pri/12345/image.png"}} ``` ### Slack Files Sample ```json {"id": "12341", "created": 1679238067, "timestamp": 1679238067, "name": "image.png", "title": "image", "mimetype": "image/png", "filetype": "png", "pretty_type": "PNG", "user": "12343", "user_team": "12345", "editable": false, "size": 39243, "mode": "hosted", "is_external": false, "external_type": "", "is_public": true, "public_url_shared": false, "display_as_bot": false, "username": "", "url_private": "https://files.slack.com/files-pri/1234-1234/image.png", "url_private_download": "https://files.slack.com/files-pri/1234-12347/download/image.png", "media_display_type": "unknown", "thumb_64": "https://files.slack.com/files-tmb/1234-1239-12341/image_64.png", "thumb_80": "https://files.slack.com/files-tmb/1234-1234-12344/image_80.png", "thumb_360": "https://files.slack.com/files-tmb/123-123-12342/image_360.png", "thumb_360_w": 360, "thumb_360_h": 266, "thumb_480": "https://files.slack.com/files-tmb/123-123-12343/image_480.png", "thumb_480_w": 480, "thumb_480_h": 355, "thumb_160": "https://files.slack.com/files-tmb/123-123-123/image_160.png", "original_w": 570, "original_h": 421, "thumb_tiny": "123/9ajP1/123/lRn6/123/123/12347/12349/Z", "permalink": "https://org.slack.com/files/123/12343/image.png", "permalink_public": "https://slack-files.com/123-123-1233", "channels": ["123414"], "groups": [], "ims": [], "comments_count": 0} ``` ### Slack Users Sample ```json {"id": "A00B111CDEF", "team_id": "TEAMID123", "name": "name1", "deleted": false, "color": "9f69e7", "real_name": "name1", "tz": "Asia/Kolkata", "tz_label": "India Standard Time", "tz_offset": 19800, "profile": {"title": "", "phone": "", "skype": "", "real_name": "name1", "real_name_normalized": "name1", "display_name": "", "display_name_normalized": "", "fields": null, "status_text": "", "status_emoji": "", "status_emoji_display_info": [], "status_expiration": 0, "avatar_hash": "1234567", "first_name": "name1", "last_name": "", "image_24": "https://test.example.com/avatar/12345.jpg", "image_32": "https://test.example.com/avatar/1234.jpg", "image_48": "https://test.example.com/avatar/123456.jpg", "image_72": "https://test.example.com/avatar/1234.jpg", "status_text_canonical": "", "team": "TEAMID123"}, "is_admin": true, "is_owner": true, "is_primary_owner": true, "is_restricted": false, "is_ultra_restricted": false, "is_bot": false, "is_app_user": false, "updated": 1667874680, "is_email_confirmed": true, "has_2fa": false, "who_can_share_contact_card": "EVERYONE"} ```