Slack (Beta)

Updated 2 weeks ago by Elvis Hovor

Introduction

A lot of SOC analyst today are leveraging collaborative tools such as Slack in their incident triage and investigations. Analysts are collaborating with their peers and ISAO/ISAC members through slack. TruSTARs integration with Slack enables analyst to leverage their intelligence source inside TruSTAR as part of their investigative workflow in tools such as Slack.

Use cases:

  1. Manage your threat intelligence: Vet and validate intelligence on external websites and collaborative chats and operationalize gathered intelligence via SEIM detection, threat hunting, orchestration all in a few clicks.
  2. Enrich your intel: Quickly identify and flag high threat or high priority indicators based on intelligence from your integration sources by running quick indicator searches from your browser using the TruSTAR Slack app.

TruSTAR Slack app features:

Submit Report: As a security analyst I want to submit intelligence from a Slack channel conversations that I am having with other analysts so that the intelligence can be enriched with data available across the TruSTAR platform. This interaction will only be visible to me.

Submit IOC: As a security analyst I want to submit IOCs from a Slack channel conversations that I am having with other analysts so that the intelligence can be enriched with data available across the TruSTAR platform. This interaction will only be visible to me.

Search: As a security analyst I want to search an IOC of interest from a Slack channel so that I can quickly assess if additional enrichment is available for the IOC of interest and pivot to the TruSTAR platform for additional research. This interaction will only be visible to me.

Installation

Slack App Install

Currently the TruSTAR slack app can not be installed from the Slack app directory. To install the slack app install from the TruSTAR marketplace

Installing Through TruSTAR Marketplace

Installing the App in a Slack Workspace
  • Login to the TruSTAR station platform.
  • Navigate to the TruSTAR marketplace.
  • Under Integrations locate the slack logo
  • Select "Set Up" button to install the the TruSTAR Slack app.
You have to be an admin of the slack workspace to install the app
  • You may be asked to sign In to your workspace

  • Select the workspace click “Authorize”.
If a non-admin tries to install the app to a workspace, the Slack admins for that user's workspace will receive emails prompting them to approve the installation, and one of them will need to approve before the app can be installed.

Manual Installation

Requirements

Install URL

https://slack.com/oauth/authorize?client_id=3911975615.603117200739&scope=commands,chat:write:bot,bot

Steps
  • Open your web browser.
  • Paste the install URL (from above) in the address bar and hit enter.
  • Select the select the workspace you will like to install the app and select “Authorize”.
  • You may be asked to sign In to your workspace
You have to be an admin of the slack workspace to install the app

  • Select the workspace click “Authorize”.
If a non-admin tries to install the app to a workspace, the Slack admins for that user's workspace will receive emails prompting them to approve the installation, and one of them will need to approve before the app can be installed.

Individual User Configuration

Each individual user who has access to the workspace that the app is installed on must complete a one-time setup in order to start using the TruSTAR slack integration.

  • To set the integration up each user needs to run the command /trustar-register,

  • This will prompt them to enter their TruSTAR API key and API secret keys.
  • Clicking on API key or API secret key hyperlinks to lead you to the TruSTAR Station page to retrieve your API credentials.
Best Practices: Sharing TruSTAR credentials in Slack will share per-minute rate limits and might affect your user experience with the App. It is advisable for each individual to use their own set of API credentials for registration.
 Any attempt any of the commands listed below in the next section without completing the registration setup you will result in an error.

Channel Restrictions

This integration uses a TruSTAR Slackbot to retrieve enrichment in response to user actions.  Channels that do not allow the use of slackbots cannot be used with this integration.

TruSTAR Slackbot can be used in any of the following channels:

  • Any public channel
  • Any channel that @TruSTAR has been invited to
  • The Slackbot channel
Users cannot use this integration in channels that the TruSTAR bot doesn’t have permission to write into.

Using the TruSTAR Slack App

  • After installing the slack app users can have a preview of TruSTAR app commands by typing in "/trustar" list of available commands and brief explanations will pop up.

Search with TruSTAR

/trustar-search <search-term> - search for an indicator

  1. Add search term after the trustar-search command and hit enter (/trustar-search wannacry)
  2. You will receive a slackbot message with enrichment from TruSTAR on that indicator

Submit Report to TruSTAR

/trustar-submit-report - brings up a dialog to submit a report

  1. Fill out a report details.
  2. Select enclave to submit report to.
  3. Add any tags if needed and submit.
  4. You will receive a slackbot message when the report is successfully submitted to TruSTAR

Submit IOCs to TruSTAR

/trustar-submit-indicators - brings up a dialog to submit IOCs through IOC management

  1. Fill out IOC list details
  1. Copy and paste the set of IOC's list you will be submitted through TruSTAR's IOC management feature
Only the IOC's in the pasted text will be extracted and submitted into the selected enclave in TruSTAR
  1. Select enclave to submit IOC list.
  2. Add any tags if required and submit.
  3. You will receive a slackbot message when the list of IOC's is successfully submitted to TruSTAR
  4. You will further receive an email when the IOC list has been parsed and submission is complete.

Known Limitations

Currently there is no way to let return an error message to a user if they post into a channel that the slackbot cannot respond to. Currently nothing is returned and users may assume the integration is working as expected.

Troubleshooting & FAQ's

Q: What data will the slack app need access to in order to work?

A: TruSTAR will be able to install a bot user that appears in and has access to your workspace’s directory. It can also post messages and view activity on messages in any channel it is invited to.

Please reach out to support@trustar.co for any additional questions.


How Did We Do?