category: Analytics & SIEM
provider: Slack
sectionorder:
- Connect
- Collect
commonfields:
  id: Slack Event Collector
  version: -1
configuration:
- defaultvalue: https://api.slack.com/audit/v1/
  display: Server URL
  name: url
  type: 0
  required: true
  section: Connect
- display: ''
  displaypassword: User Token
  name: user_token
  type: 9
  required: true
  hiddenusername: true
  section: Connect
- display: Fetch Events
  name: isFetchEvents
  type: 8
  required: false
  section: Collect
- name: eventFetchInterval
  section: Collect
  display: Events Fetch Interval
  advanced: true
  defaultvalue: "1"
  type: 19
  required: false
- defaultvalue: 1000
  display: The maximum number of audit logs to fetch
  name: limit
  type: 0
  section: Collect
  required: false
- defaultvalue: '10 minutes ago'
  display: First fetch time interval
  name: oldest
  type: 0
  additionalinfo: Data is not available prior to March 2018.
  section: Collect
  required: false
- display: Trust any certificate (not secure)
  name: insecure
  type: 8
  additionalinfo:
  section: Connect
  advanced: true
  required: false
- display: Use system proxy settings
  name: proxy
  type: 8
  additionalinfo:
  section: Connect
  advanced: true
  required: false
description: Slack logs event collector integration for XSIAM.
display: Slack Event Collector
name: Slack Event Collector
script:
  commands:
  - arguments:
    - auto: PREDEFINED
      defaultValue: 'false'
      description: If true, the command will create events, otherwise it will only display them.
      name: should_push_events
      predefined:
      - 'true'
      - 'false'
      required: true
    - description: The maximum number of audit log events to return. The command collects events oldest-first and keeps fetching until this limit is reached.
      name: limit
      defaultValue: 10
      type: number
    - description: The occurrence time of the least recent audit event to include (inclusive), i.e. the date to fetch events from. Data is not available prior to March 2018. Accepted formats are ISO 8601 or relative time (e.g., "3 days").
      name: oldest
      defaultValue: 3 days
      type: date
    - description: The occurrence time of the most recent audit event to include (inclusive), i.e. the date to fetch events until. Accepted formats are ISO 8601 or relative time (e.g., "3 days").
      name: latest
      defaultValue: now
      type: date
    - description: Name of the action.
      name: action
    - description: ID of the user who initiated the action.
      name: actor
    - description: ID of the target entity of the action (such as a channel, workspace, organization, file).
      name: entity
    description: Gets audit log events from Slack. Use this command for development and debugging only, as it may produce duplicate events, exceed API rate limits, or disrupt the fetch mechanism.
    name: slack-get-events
  script: '-'
  type: python
  subtype: python3
  isfetchevents: true
  dockerimage: demisto/python3:3.12.13.10116658
marketplaces:
- marketplacev2
- platform
supportedModules:
- xsiam
fromversion: 6.8.0
tests:
- No tests (auto formatted)