Collect Slack audit logs

Supported in:

Google secops SIEM

Note: This feature is covered by Pre-GA Offerings Terms of the Google Security Operations Service Specific Terms. Pre-GA features might have limited support, and changes to pre-GA features might not be compatible with other pre-GA versions. For more information, see the Google SecOps Technical Support Service guidelines and the Google SecOps Service Specific Terms.

This document explains how to ingest Slack Audit Logs to Google Security Operations using Google Cloud Run functions. The parser handles two formats of Slack audit logs. It first normalizes boolean values and clears predefined fields. Then, it parses the "message" field as JSON, handling non-JSON messages by dropping them. Depending on the presence of specific fields (date_create and user_id), the parser applies different logic to map raw log fields to the UDM, including metadata, principal, network, target, and about information, and constructs a security result.

Before you begin

Make sure you have the following prerequisites:

• A Google SecOps instance
• Privileged access to Slack Enterprise Grid tenant and Admin Console
• Privileged access to GCP Cloud Run functions and Cloud Scheduler

Collect Slack Audit Logs prerequisites (App ID, OAuth Token, Organization ID)

1. Sign in to the Slack Admin Console for your Enterprise Grid organization.
2. Go to https://api.slack.com/apps and click Create New App > From scratch.
3. Enter the App Name and select your Development Slack Workspace.
4. Click Create App.
5. Navigate to OAuth & Permissions in the left sidebar.
6. Go to the Scopes section and add the following User Token Scope:
   • auditlogs:read
7. Click Install to Workspace > Allow.
8. Once installed, navigate to Org Level Apps > Install to Organization.
9. Authorize the app with an Organization Owner/Admin account.
10. Copy and securely save the User OAuth Token that starts with xoxp- (this is your SLACK_ADMIN_TOKEN).
11. Copy your Organization ID which can be found in the Slack Admin Console under Settings & Permissions > Organization settings.

Setting up the directory

1. Create a new directory on your local machine for the Cloud Run function deployment.
2. Download the following files from the Chronicle ingestion-scripts GitHub repository:
   • From the slack folder, download:
     • .env.yml
     • main.py
     • requirements.txt
   • From the root of the repository, download the entire common directory with all its files:
     • common/__init__.py
     • common/auth.py
     • common/env_constants.py
     • common/ingest.py
     • common/status.py
     • common/utils.py
3. Place all downloaded files into your deployment directory.

Your directory structure should look like this:

  deployment_directory/
  ├─common/
  │ ├─__init__.py
  │ ├─auth.py
  │ ├─env_constants.py
  │ ├─ingest.py
  │ ├─status.py
  │ └─utils.py
  ├─.env.yml
  ├─main.py
  └─requirements.txt

Create secrets in Google Secret Manager

1. In the Google Cloud console, go to Security > Secret Manager.
2. Click Create Secret.
3. Provide the following configuration details for the Chronicle service account:
   • Name: Enter chronicle-service-account.
   • Secret value: Paste the contents of your Google SecOps ingestion authentication JSON file.
4. Click Create secret.

5. Copy the secret resource name in the following format:

   projects/<PROJECT_ID>/secrets/chronicle-service-account/versions/latest
   

6. Click Create Secret again to create a second secret.

7. Provide the following configuration details for the Slack token:

   • Name: Enter slack-admin-token.
   • Secret value: Paste your Slack User OAuth Token (starting with xoxp-).

8. Click Create secret.

9. Copy the secret resource name in the following format:

     projects/<PROJECT_ID>/secrets/slack-admin-token/versions/latest
   

Setting the required runtime environment variables

1. Open the .env.yml file in your deployment directory.

2. Configure the environment variables with your values:

   CHRONICLE_CUSTOMER_ID: "<your-chronicle-customer-id>"
   CHRONICLE_REGION: us
   CHRONICLE_SERVICE_ACCOUNT: "projects/<PROJECT_ID>/secrets/chronicle-service-account/versions/latest"
   CHRONICLE_NAMESPACE: ""
   POLL_INTERVAL: "5"
   SLACK_ADMIN_TOKEN: "projects/<PROJECT_ID>/secrets/slack-admin-token/versions/latest"
   

   • Replace the following:
     • <your-chronicle-customer-id>: Your Google SecOps customer ID.
     • <PROJECT_ID>: Your Google Cloud project ID.
     • CHRONICLE_REGION: Set to your Google SecOps region. Valid values: us, asia-northeast1, asia-south1, asia-southeast1, australia-southeast1, europe, europe-west2, europe-west3, europe-west6, europe-west9, europe-west12, me-central1, me-central2, me-west1, northamerica-northeast2, southamerica-east1.
     • POLL_INTERVAL: Frequency interval (in minutes) at which the function executes. This duration must be the same as the Cloud Scheduler job interval.

3. Save the .env.yml file.

Deploying the Cloud Run function

1. Open a terminal or Cloud Shell in the Google Cloud console.

2. Navigate to your deployment directory:

   cd /path/to/deployment_directory
   

3. Execute the following command to deploy the Cloud Run function:

   gcloud functions deploy slack-audit-to-chronicle \
     --entry-point main \
     --trigger-http \
     --runtime python39 \
     --env-vars-file .env.yml \
     --timeout 300s \
     --memory 512MB \
     --service-account <SERVICE_ACCOUNT_EMAIL>
   

   • Replace <SERVICE_ACCOUNT_EMAIL> with the email address of the service account you want your Cloud Run function to use.
   Note: The service account running your Cloud Run function must have the Cloud Functions Invoker (roles/cloudfunctions.invoker) and Secret Manager Secret Accessor (roles/secretmanager.secretAccessor) roles.

4. Wait for the deployment to complete.

5. Once deployed, note the function URL from the output.

Set up Cloud Scheduler

1. In the Google Cloud console, go to Cloud Scheduler > Create job.
2. Provide the following configuration details:
   • Name: Enter slack-audit-scheduler.
   • Region: Select the same region where you deployed the Cloud Run function.
   • Frequency: Enter */5 * * * * (runs every 5 minutes, matching the POLL_INTERVAL value).
   • Timezone: Select UTC.
   • Target type: Select HTTP.
   • URL: Enter the Cloud Run function URL from the deployment output.
   • HTTP method: Select POST.
   • Auth header: Select Add OIDC token.
   • Service account: Select the same service account used for the Cloud Run function.
3. Click Create.

UDM Mapping Table

Log Field	UDM Mapping	Logic
action	metadata.product_event_type	Directly mapped from the action field in the raw log.
actor.type	principal.labels.value	Directly mapped from the actor.type field, with the key actor.type added.
actor.user.email	principal.user.email_addresses	Directly mapped from the actor.user.email field.
actor.user.id	principal.user.product_object_id	Directly mapped from the actor.user.id field.
actor.user.id	principal.user.userid	Directly mapped from the actor.user.id field.
actor.user.name	principal.user.user_display_name	Directly mapped from the actor.user.name field.
actor.user.team	principal.user.group_identifiers	Directly mapped from the actor.user.team field.
context.ip_address	principal.ip	Directly mapped from the context.ip_address field.
context.location.domain	about.resource.attribute.labels.value	Directly mapped from the context.location.domain field, with the key context.location.domain added.
context.location.id	about.resource.id	Directly mapped from the context.location.id field.
context.location.name	about.resource.name	Directly mapped from the context.location.name field.
context.location.name	about.resource.attribute.labels.value	Directly mapped from the context.location.name field, with the key context.location.name added.
context.location.type	about.resource.resource_subtype	Directly mapped from the context.location.type field.
context.session_id	network.session_id	Directly mapped from the context.session_id field.
context.ua	network.http.user_agent	Directly mapped from the context.ua field.
context.ua	network.http.parsed_user_agent	Parsed user agent information derived from the context.ua field using the parseduseragent filter.
country	principal.location.country_or_region	Directly mapped from the country field.
date_create	metadata.event_timestamp.seconds	The epoch timestamp from the date_create field is converted to a timestamp object.
details.inviter.email	target.user.email_addresses	Directly mapped from the details.inviter.email field.
details.inviter.id	target.user.product_object_id	Directly mapped from the details.inviter.id field.
details.inviter.name	target.user.user_display_name	Directly mapped from the details.inviter.name field.
details.inviter.team	target.user.group_identifiers	Directly mapped from the details.inviter.team field.
details.reason	security_result.description	Directly mapped from the details.reason field, or if it's an array, concatenated with commas.
details.type	about.resource.attribute.labels.value	Directly mapped from the details.type field, with the key details.type added.
details.type	security_result.summary	Directly mapped from the details.type field.
entity.app.id	target.resource.id	Directly mapped from the entity.app.id field.
entity.app.name	target.resource.name	Directly mapped from the entity.app.name field.
entity.channel.id	target.resource.id	Directly mapped from the entity.channel.id field.
entity.channel.name	target.resource.name	Directly mapped from the entity.channel.name field.
entity.channel.privacy	target.resource.attribute.labels.value	Directly mapped from the entity.channel.privacy field, with the key entity.channel.privacy added.
entity.file.filetype	target.resource.attribute.labels.value	Directly mapped from the entity.file.filetype field, with the key entity.file.filetype added.
entity.file.id	target.resource.id	Directly mapped from the entity.file.id field.
entity.file.name	target.resource.name	Directly mapped from the entity.file.name field.
entity.file.title	target.resource.attribute.labels.value	Directly mapped from the entity.file.title field, with the key entity.file.title added.
entity.huddle.date_end	about.resource.attribute.labels.value	Directly mapped from the entity.huddle.date_end field, with the key entity.huddle.date_end added.
entity.huddle.date_start	about.resource.attribute.labels.value	Directly mapped from the entity.huddle.date_start field, with the key entity.huddle.date_start added.
entity.huddle.id	about.resource.attribute.labels.value	Directly mapped from the entity.huddle.id field, with the key entity.huddle.id added.
entity.huddle.participants.0	about.resource.attribute.labels.value	Directly mapped from the entity.huddle.participants.0 field, with the key entity.huddle.participants.0 added.
entity.huddle.participants.1	about.resource.attribute.labels.value	Directly mapped from the entity.huddle.participants.1 field, with the key entity.huddle.participants.1 added.
entity.type	target.resource.resource_subtype	Directly mapped from the entity.type field.
entity.user.email	target.user.email_addresses	Directly mapped from the entity.user.email field.
entity.user.id	target.user.product_object_id	Directly mapped from the entity.user.id field.
entity.user.name	target.user.user_display_name	Directly mapped from the entity.user.name field.
entity.user.team	target.user.group_identifiers	Directly mapped from the entity.user.team field.
entity.workflow.id	target.resource.id	Directly mapped from the entity.workflow.id field.
entity.workflow.name	target.resource.name	Directly mapped from the entity.workflow.name field.
id	metadata.product_log_id	Directly mapped from the id field.
ip	principal.ip	Directly mapped from the ip field. Determined by logic based on the action field. Defaults to USER_COMMUNICATION, but changes to other values like USER_CREATION, USER_LOGIN, USER_LOGOUT, USER_RESOURCE_ACCESS, USER_RESOURCE_UPDATE_PERMISSIONS, or USER_CHANGE_PERMISSIONS based on the value of action. Hardcoded to "SLACK_AUDIT". Set to "Enterprise Grid" if date_create exists, otherwise set to "Audit Logs" if user_id exists. Hardcoded to "Slack". Hardcoded to "REMOTE". Set to "SSO" if action contains "user_login" or "user_logout". Otherwise, set to "MACHINE". Not mapped in the provided examples. Defaults to "ALLOW", but set to "BLOCK" if action is "user_login_failed". Set to "Slack" if date_create exists, otherwise set to "SLACK" if user_id exists.
user_agent	network.http.user_agent	Directly mapped from the user_agent field.
user_id	principal.user.product_object_id	Directly mapped from the user_id field.
username	principal.user.product_object_id	Directly mapped from the username field.

Need more help? Get answers from Community members and Google SecOps professionals.