Slack

Slack v3.0.0

Home FortiSOAR Connectors Slack

3.0.0

Slack v3.0.0

About the connector

Slack is a cloud-based set of proprietary team collaboration tools and services. Slack creates alignment and shared understanding across your team, making you more productive and less stressed. It brings all your team's communication together, giving everyone a shared workspace where conversations are organized and accessible.

This document provides information about the Slack connector, which facilitates automated interactions, with Slack using FortiSOAR™ playbooks. Add the Slack connector as a step in FortiSOAR™ playbooks and perform automated operations, such as retrieving a list of all channels and users configured in your Slack cloud, retrieving information about a user that is configured in your Slack cloud, and sending a message to a channel configured in your Slack cloud.

The FortiSOAR for Slack application (app) builds a bridge for seamless integration with FortiSOAR, allowing you to leverage the power of FortiSOAR as part of your daily communications and threat investigation routines. For more information, see the FortiSOAR for Slack Application document.

Version information

Connector Version: 3.0.0

FortiSOAR™ Version Tested on: 7.3.1

Authored By: Fortinet

Certified: Yes

Release Notes for version 3.0.0

The following enhancements have been made to the Slack connector in version 3.0.0:

Added the 'Enable Bot Communication' configuration parameter to enable bi-directional communication between FortiSOAR and Slack using the FortiSOAR for Slack application. For more information, see the FortiSOAR for Slack Application document.
Added the 'Send via Email Address', 'Blocks', and 'Thread TS' input parameters to the "Send Message" action.
Added a new action named "Send Manual Input/Approval from Slack".

Installing the connector

Use the Content Hub to install the connector. For the detailed procedure to install a connector, click here.
You can also use the following yum command as a root user to install connectors from an SSH session:
yum install cyops-connector-slack

Prerequisites to configuring the connector

You must have the URL of the Slack cloud to which you will connect and perform the automated operations and the OAuth authentication token configured for your account to access that Slack cloud.
The FortiSOAR™ server should have outbound connectivity to port 443 on the Slack cloud.

Minimum Permissions Required

IMPORTANT: If you require bi-directional integration between FortiSOAR and Slack, then you must use the app template of FortiSOAR For Slack Application for appropriate permissions. However, if you require to use only the connector actions, then you can initialize the app from a blank template as mentioned in the Creating and installing a Slack App in a workspace topic. Permissions required for each action are listed in the Permissions table in this topic.

Configuring the connector

For the procedure to configure a connector, click here.

Configuration parameters

In FortiSOAR™, on the Content Hub (or Connector Store) page, click the Manage tab, and then click the Slack connector card. On the connector popup, click the Configurations tab to enter the required configuration details.

Parameter	Description
Server URL	URL of the Slack cloud to which you will connect and perform automated operations.
OAuth Token	The OAuth Token contains required scopes that are configured for your account for the Slack cloud to which you will connect and perform the automated operations. IMPORTANT: If you require bi-directional integration between FortiSOAR and Slack, then you must use the app template of FortiSOAR For Slack Application for appropriate permissions and to generate an OAuth Token. However, if you require to use only the connector actions, then you can initialize the app from a blank template and generate the OAUTH token as mentioned in the Creating and installing a Slack App in a workspace topic. Permissions required for each action are listed in the Permissions table in this topic.
Verify SSL	Specifies whether the SSL certificate for the server is to be verified or not. Defaults to `True`.
Enable Bot Communication	Select this option if you want to enable bi-directional communication between Slack and FortiSOAR. If you select this option, then in the App Level Token enter the App Level token for the FortiSOAR For Slack App, which contains the required scopes configured for your app. For more information, see the FortiSOAR for Slack Application document. IMPORTANT: The bi-directional communication between Slack and FortiSOAR is supported only on FortiSOAR nodes, i.e., this feature is currently not supported on FSR Agent nodes. Also, bi-directional communication between Slack and FortiSOAR is not supported in an air-gapped environment.

Actions supported by the connector

The following automated operations can be included in playbooks and you can also use the annotations to access operations from FortiSOAR:

Function	Description	Annotation and Category
Get Message History	Fetches the history of messages and events for a specific conversation from your Slack cloud, based on the Channel ID and other input parameters that you have specified.	get_message_history Investigation
Create Channel	Creates a new channel in your configured Slack cloud, based on the channel name and other input parameters that you have specified.	create_channel Investigation
Get Channels List	Retrieves a list of channels and their details, available in a slack team, from your configured Slack cloud.	get_channels Investigation
Search Channel	Retrieves detailed information about a specific channel, based on the channel name that you have specified, from your configured Slack cloud.	get_channel Investigation
Get Channel Information	Retrieves information about conversations of a specific channel from your configured Slack cloud, based on the channel ID and other input parameters that you have specified.	get_channel_info Investigation
Rename Channel	Renames a channel (conversation) on your configured Slack cloud based on the channel ID and new channel name that you have specified. Note: You can rename a channel only if you are the owner of the channel or if you have "admin" permissions.	rename_channel Investigation
Invite Users To Channel	Invites users to a specified channel on your configured Slack cloud based on the channel ID and user IDs that you have specified.	invite_user_to_channel Investigation
Close Channel	Closes a direct message or multi-person direct message on your configured Slack cloud based on the channel ID that you have specified.	close_channel Investigation
Get User List	Retrieves a list of users and their details, available in a slack team, from your configured Slack cloud.	get_users Investigation
Get User Information	Retrieves detailed information of a specific user from your configured Slack cloud based on the search criteria that you have specified.	get_user Investigation
Send Message	Sends a message to a specific channel configured on your Slack cloud, based on the Channel ID, message, and other input parameters that you have specified.	send_message Investigation
Send Manual Input/Approval Form to Slack	Sends a manual input form or approval request to Slack based on the input object that you have specified.	send_input Investigation
Upload File	Uploads a file to a specific channel configured on your Slack cloud, based on the Channel ID, message, and other input parameters that you have specified.	upload_file Miscellaneous

operation: Get Message History

Input parameters

Parameter	Description
Channel ID/User ID	Unique ID of the channel, private group, or IM channel whose conversation history you want to fetch from your Slack cloud.
Cursor	Paginate through collections of data by setting the cursor parameter to the `next_cursor` attribute returned by a previous request's `response_metadata`. By default, the value fetched is the first "page" of the collection.
Inclusive	Include messages with the latest or oldest timestamp in results only when either timestamp is specified. By default, this is set to 0.
Start Time	Start DateTime of the messages whose history you want to retrieve from your Slack cloud.
End Time	End DateTime of the messages whose history you want to retrieve from your Slack cloud.
Limit	The maximum number of items that this operation should return. Note: If you set the "Limit" parameter, then fewer than the requested number of items might be returned if the limit set is reached, even if the end of the users' list has not been reached.

Output

The output contains the following populated JSON schema:
{
"ok": "",
"has_more": "",
"messages": [
{
"ts": "",
"team": "",
"text": "",
"type": "",
"user": "",
"blocks": [
{
"type": "",
"block_id": "",
"elements": [
{
"type": "",
"elements": [
{
"text": "",
"type": ""
}
]
}
]
}
],
"client_msg_id": ""
}
],
"pin_count": "",
"response_metadata": {
"next_cursor": ""
},
"channel_actions_ts": "",
"channel_actions_count": ""
}

operation: Create Channel

Input parameters

Parameter	Description
Channel Name	Name of the public or private channel that you want to create on your Slack cloud.
Is Private	Select this option to create a private channel on your Slack cloud. If you leave this unchecked then a public (default) channel will be created on your Slack cloud.

Output

The output contains the following populated JSON schema:
{
"channel": {
"is_mpim": "",
"is_archived": "",
"pending_connected_team_ids": [],
"is_ext_shared": "",
"is_shared": "",
"name_normalized": "",
"unlinked": "",
"purpose": {
"creator": "",
"value": "",
"last_set": ""
},
"is_open": "",
"is_group": "",
"is_pending_ext_shared": "",
"priority": "",
"shared_team_ids": [],
"last_read": "",
"is_private": "",
"name": "",
"topic": {
"creator": "",
"value": "",
"last_set": ""
},
"pending_shared": [],
"id": "",
"is_org_shared": "",
"parent_conversation": "",
"creator": "",
"is_im": "",
"created": "",
"is_channel": "",
"is_member": "",
"is_general": ""
},
"headers": {
"x-accepted-oauth-scopes": "",
"access-control-expose-headers": "",
"access-control-allow-headers": "",
"access-control-allow-origin": "*",
"strict-transport-security": "",
"referrer-policy": "",
"x-content-type-options": "",
"x-slack-req-id": "",
"x-oauth-scopes": "",
"content-encoding": "",
"x-slack-backend": "",
"x-xss-protection": "",
"content-length": "",
"server": "",
"vary": "",
"date": "",
"pragma": "",
"content-type": "",
"cache-control": "",
"expires": "",
"x-via": ""
},
"ok": ""
}

operation: Get Channels List

Input parameters

Note: All the input parameters are optional. However, if you do not specify any parameter, then no filter criterion is applied and an unfiltered list is returned.

Parameter	Description
Exclude Archived	Select this option, i.e., set it as `true`, to exclude archived channels from the list of channels retrieved from your configured Slack cloud. By default, this is set as `false`.
Maximum Records	The maximum number of records you want this operation to return. By default, this is set as `0`.
Channel Types	Types of channels that you want to retrieve from your configured Slack cloud. You can choose from the following options: Public Channel, Private Channel, Group messaging, or Direct Messages.
Cursor	Paginate through collections of data by setting the cursor parameter to the `next_cursor` attribute returned by a previous request's `response_metadata`. By default, the value fetched is the first "page" of the collection.

Output

The JSON output contains a list of all channels along with their details, such as id, creator name, and purpose, present in a Slack team, retrieved from your configured Slack cloud.

The output contains the following populated JSON schema:
{
"channels": [
{
"is_private": "",
"is_org_shared": "",
"name": "",
"is_archived": "",
"topic": {
"creator": "",
"value": "",
"last_set": ""
},
"id": "",
"is_shared": "",
"num_members": "",
"name_normalized": "",
"creator": "",
"purpose": {
"creator": "",
"value": "",
"last_set": ""
},
"created": "",
"is_mpim": "",
"is_channel": "",
"unlinked": "",
"previous_names": [],
"is_member": "",
"members": [],
"is_general": ""
}
],
"headers": {
"x-accepted-oauth-scopes": "",
"access-control-expose-headers": "",
"access-control-allow-headers": "",
"access-control-allow-origin": "*",
"strict-transport-security": "",
"referrer-policy": "",
"x-content-type-options": "",
"x-slack-req-id": "",
"x-oauth-scopes": "",
"content-encoding": "",
"x-slack-backend": "",
"x-xss-protection": "",
"content-length": "",
"server": "",
"vary": "",
"date": "",
"pragma": "",
"content-type": "",
"cache-control": "",
"expires": "",
"x-via": ""
},
"ok": ""
}

operation: Search Channel

Input parameters

Parameter	Description
Channel to Search	Name of the channel whose details you want to retrieve from your configured Slack cloud.
Type of Search	Type of filter option that you want to apply to the search operation. You can choose from the following options: Exact, Contains, Starts With, or Ends With.

Output

The JSON output contains detailed information about a channel such as ID, creator name, and purpose, retrieved from your configured Slack cloud, based on the channel name that you have specified.

The output contains the following populated JSON schema:
{
"status": "",
"data": [
{
"is_private": "",
"is_org_shared": "",
"name": "",
"is_archived": "",
"topic": {
"creator": "",
"value": "",
"last_set": ""
},
"id": "",
"is_shared": "",
"num_members": "",
"name_normalized": "",
"creator": "",
"purpose": {
"creator": "",
"value": "",
"last_set": ""
},
"created": "",
"is_mpim": "",
"is_channel": "",
"unlinked": "",
"previous_names": [],
"is_member": "",
"members": [],
"is_general": ""
}
],
"message": ""
}

operation: Get Channel Information

Input parameters

Parameter	Description
Channel ID	The ID of the channel (conversations) you want to retrieve from your configured Slack cloud.
Include Locale	Select this checkbox, i.e., set it to `true` to include the locale of the specified conversations retrieved from your configured Slack cloud. By default, this is set to `false`, i.e., the checkbox is unchecked.
Include Number Of Members	Select this checkbox, i.e., set it to `true`, to include the member count of the specified conversations retrieved from your configured Slack cloud. By default, this is set to `false`, i.e., the checkbox is unchecked.

Output

operation: Rename Channel

Input parameters

Parameter	Description
Channel ID	The ID of the channel you want to rename on your configured Slack cloud.
Channel Name	The new name that you want to assign to the specified channel on your configured Slack cloud.

Output

The output contains the following populated JSON schema:
{
"channel": {
"is_mpim": "",
"is_archived": "",
"pending_connected_team_ids": [],
"is_ext_shared": "",
"is_shared": "",
"name_normalized": "",
"unlinked": "",
"purpose": {
"creator": "",
"value": "",
"last_set": ""
},
"is_open": "",
"is_group": "",
"is_pending_ext_shared": "",
"shared_team_ids": [],
"last_read": "",
"is_private": "",
"name": "",
"topic": {
"creator": "",
"value": "",
"last_set": ""
},
"pending_shared": [],
"id": "",
"is_org_shared": "",
"parent_conversation": "",
"creator": "",
"is_im": "",
"created": "",
"is_channel": "",
"is_member": "",
"is_general": ""
},
"headers": {
"x-accepted-oauth-scopes": "",
"access-control-expose-headers": "",
"access-control-allow-headers": "",
"access-control-allow-origin": "*",
"strict-transport-security": "",
"referrer-policy": "",
"x-content-type-options": "",
"x-slack-req-id": "",
"x-oauth-scopes": "",
"content-encoding": "",
"x-slack-backend": "",
"x-xss-protection": "",
"content-length": "",
"server": "",
"vary": "",
"date": "",
"pragma": "",
"content-type": "",
"cache-control": "",
"expires": "",
"x-via": ""
},
"ok": ""
}

operation: Invite Users To Channel

Input parameters

Parameter	Description
Channel ID	The ID of the public or private channel to which you want to invite specified users.
User IDs	Comma-separated list of user IDs that you want to invite to the specified channel. Note: You can list a maximum of 1000 users.

Output

operation: Close Channel

Input parameters

Parameter	Description
Channel ID	The ID of the direct message (channel) or multi-person direct message you want to close on your configured Slack cloud.

Output

The output contains the following populated JSON schema:
{
"no_op": "",
"headers": {
"x-accepted-oauth-scopes": "",
"access-control-expose-headers": "",
"access-control-allow-headers": "",
"access-control-allow-origin": "*",
"strict-transport-security": "",
"referrer-policy": "",
"x-content-type-options": "",
"x-slack-req-id": "",
"x-oauth-scopes": "",
"content-encoding": "",
"x-slack-backend": "",
"x-xss-protection": "",
"content-length": "",
"server": "",
"vary": "",
"date": "",
"pragma": "",
"content-type": "",
"cache-control": "",
"expires": "",
"x-via": ""
},
"ok": "",
"already_closed": ""
}

operation: Get User List

Input parameters

Note: All the input parameters are optional. However, if you do not specify any parameter, then no filter criterion is applied and an unfiltered list is returned.

Parameter	Description
Maximum Records	The maximum number of records you want this operation to return. By default, this is set as `0`.
Cursor	Set this parameter to a `next_cursor` attribute returned by a previous request's `response_metadata`.

Output

The JSON output contains a list of all members along with their profile details, such as last name, phone number, id, and team id, present in a Slack team, retrieved from your configured Slack cloud.

The output contains the following populated JSON schema:
{
"cache_ts": "",
"headers": {
"x-accepted-oauth-scopes": "",
"access-control-expose-headers": "",
"access-control-allow-headers": "",
"access-control-allow-origin": "*",
"strict-transport-security": "",
"referrer-policy": "",
"x-content-type-options": "",
"x-slack-req-id": "",
"x-oauth-scopes": "",
"content-encoding": "",
"x-slack-backend": "",
"x-xss-protection": "",
"server": "",
"vary": "",
"x-via": "",
"date": "",
"pragma": "",
"content-type": "",
"cache-control": "",
"expires": "",
"transfer-encoding": ""
},
"ok": "",
"members": [
{
"is_app_user": "",
"team_id": "",
"updated": "",
"name": "",
"is_restricted": "",
"deleted": "",
"is_owner": "",
"tz_label": "",
"color": "",
"tz_offset": "",
"is_admin": "",
"is_ultra_restricted": "",
"real_name": "",
"profile": {
"image_24": "",
"display_name_normalized": "",
"status_emoji": "",
"title": "",
"skype": "",
"image_512": "",
"status_expiration": "",
"image_192": "",
"team": "",
"avatar_hash": "",
"real_name_normalized": "",
"phone": "",
"image_32": "",
"always_active": "",
"real_name": "",
"status_text_canonical": "",
"display_name": "",
"status_text": "",
"image_72": "",
"fields": "",
"last_name": "",
"first_name": "",
"image_48": ""
},
"is_bot": "",
"is_primary_owner": "",
"id": "",
"tz": null
}
]
}

operation: Get User Information

Input parameters

Parameter Description

User ID

Parameter	Description
User ID	Select the option using which you want to search for a particular user on your configured Slack cloud. You can choose from the following options: Alias, Username, or User ID If you choose Alias, then you must specify the following parameters: Alias Name: Alias name of the user whose details you want to retrieve from your configured Slack cloud. Search Type: Type of filter option that you want to apply to the search operation. You can choose from the following options: Exact, Contains, Starts With, or Ends With. If you choose Username, then you must specify the following parameters: Username To Search: The username of the user whose details you want to retrieve from your configured Slack cloud. Search Type: Type of filter option that you want to apply to the search operation. You can choose from the following options: Exact, Contains, Starts With, or Ends With. If you choose User ID, then you must specify the following parameters: User ID: Unique ID of the users whose details you want to retrieve from your configured Slack cloud. Include Locale: Select this option, i.e., set it to `true` to include locale information of the specified user retrieved from your configured Slack cloud. By default, this is set to `false`.

Select the option using which you want to search for a particular user on your configured Slack cloud. You can choose from the following options: Alias, Username, or User ID
If you choose Alias, then you must specify the following parameters:

Alias Name: Alias name of the user whose details you want to retrieve from your configured Slack cloud.
Search Type: Type of filter option that you want to apply to the search operation.
You can choose from the following options: Exact, Contains, Starts With, or Ends With.

If you choose Username, then you must specify the following parameters:

Username To Search: The username of the user whose details you want to retrieve from your configured Slack cloud.
Search Type: Type of filter option that you want to apply to the search operation.
You can choose from the following options: Exact, Contains, Starts With, or Ends With.

If you choose User ID, then you must specify the following parameters:

User ID: Unique ID of the users whose details you want to retrieve from your configured Slack cloud.
Include Locale: Select this option, i.e., set it to true to include locale information of the specified user retrieved from your configured Slack cloud.
By default, this is set to false.

Output

The JSON output contains detailed information about the user such as name, real name, profile details, and team id, retrieved from your configured Slack cloud, based on the user ID that you have specified.

The output contains the following populated JSON schema:
{
"status": "",
"data": [
{
"is_app_user": "",
"team_id": "",
"updated": "",
"name": "",
"is_restricted": "",
"deleted": "",
"is_owner": "",
"tz_label": "",
"color": "",
"tz_offset": "",
"has_2fa": "",
"is_admin": "",
"is_ultra_restricted": "",
"real_name": "",
"profile": {
"image_24": "",
"display_name_normalized": "",
"status_emoji": "",
"title": "",
"skype": "",
"image_512": "",
"status_expiration": "",
"image_192": "",
"team": "",
"avatar_hash": "",
"real_name_normalized": "",
"last_name": "",
"phone": "",
"image_32": "",
"is_custom_image": "",
"real_name": "",
"status_text_canonical": "",
"display_name": "",
"status_text": "",
"image_1024": "",
"image_72": "",
"image_48": "",
"first_name": "",
"email": "",
"image_original": ""
},
"is_bot": "",
"is_primary_owner": "",
"id": "",
"tz": ""
}
],
"message": ""
}

operation: Send Message

Input parameters

Parameter	Description
Channel ID/User ID	Unique ID of the channel, private group, or IM channel to which you want to send the message on your configured Slack cloud. You can enter either an encoded ID or a name in this field. Note: To get the current users' context in the case of the FortiSOAR for Slack app, use `vars.bot_context.user_id`, for the current users' ID, and `vars.bot_context.channel_id` for the ID of the Slack channel that has triggered the playbook. As an example, you can refer to the sample playbooks included in "02 - Use Case - FortiSOAR for Slack" playbook collection, which is shipped with the FortiSOAR For Slack solution pack.
Send via Email Address	(Optional) To send the message using an 'Email', then enter the email address of the users to whom you want to send the message.
Message	The message that you want to send to the channel that you have specified on your configured Slack cloud.
Blocks	(Optional) A JSON-based array of structured blocks presented as a URL-encoded string. For more information on Blocks, see the Block Kit documentation.
Attachments	(Optional) A JSON-based array of structured attachments. For example: `[` `{` `"fallback": "ReferenceError - UI is not defined",` `"text": "ReferenceError - UI is not defined",` `"fields": [` `{` `"title": "Project",` `"value": "Awesome Project",` `"short": true` `},` `{` `"title": "Environment",` `"value": "production",` `"short": true` `}` `],` `"color": "#F35A00"` `}` `]` Note: For more information on how to set attachments, see https://api.slack.com/docs/message-attachments.
Thread TS	(Optional) The Threat TS ID if you are sending the message as part of a threaded message.

NOTE: Use the 'Send Message' action to send customized messages directly to Slack users. For example, you can use the https://app.slack.com/block-kit-builder/ utility to create or get your own block code and then send beautifully formatted messages to Slack! Once you get your code block using the block kit builder, you can drop that code in the 'Blocks' parameter.

Output

The JSON output contains details of the message sent to the Slack channel that you have specified. Message details such as bot id, type, text, and attachment details, are included in the JSON output.

The output contains the following populated JSON schema:
{
"ok": "",
"channel": "",
"ts": "",
"message": {
"bot_id": "",
"type": "",
"text": "",
"user": "",
"ts": "",
"team": "",
"bot_profile": {
"id": "",
"deleted": "",
"name": "",
"updated": "",
"app_id": "",
"icons": {},
"team_id": ""
}
},
"headers": {
"date": "",
"server": "",
"x-slack-req-id": "",
"x-oauth-scopes": "",
"x-accepted-oauth-scopes": "",
"access-control-expose-headers": "",
"x-slack-backend": "",
"x-content-type-options": "",
"expires": "",
"cache-control": "",
"x-xss-protection": "",
"vary": "",
"pragma": "",
"access-control-allow-headers": "",
"strict-transport-security": "",
"referrer-policy": "",
"content-encoding": "",
"access-control-allow-origin": "*",
"content-length": "",
"content-type": "",
"x-via": ""
}
}

operation: Send Manual Input/Approval Form to Slack

Input parameters

Parameter	Description
Input	The FortiSOAR Manual Input object that can either be an input form or an approval request, which you want to send to Slack and get the users' response.

NOTE: The 'Send Manual Input/Approval Form to Slack' action internally prepares the mapping code for the form object as expected by Slack and renders that form in Slack. However, if you want to send customized messages directly to Slack users, then you use the 'Send Message' action. For example, you can use the https://app.slack.com/block-kit-builder/ utility to create or get your own block code and then send beautifully formatted messages to Slack! Once you get your code block using the block kit builder, you can drop that code in the 'Blocks' field of the Send Message action.

Output

operation: Upload File

Input parameters

Note: You can upload only those files that are directly accessible from FortiSOAR™ to the Slack channels on your configured Slack cloud.

Parameter	Description
Channel ID	(Optional) Comma-separated list of channel names or IDs to which you want to upload the file on your configured Slack cloud. Note: If you do not provide any channel ID, then the files will be stored in the 'Files' section of your configured Slack Cloud.
Title	(Optional) Title of the file that you want to upload to the specified Slack channels.
File Name	(Optional) Name of the file that you want to upload to the specified Slack channels.
File Type	(Optional) Type of the file that you want to upload to the specified Slack channels.
File Reference	Type of file reference that you will be providing for the file that you want to upload to the specified Slack channels. You can choose from the following options: Attachment ID or File IRI. If you choose Attachment ID, then you must specify the following parameter: Attachment ID: ID of the attachment that you want to upload to the specified Slack channels. The Attachment ID is used to access the file directly from the FortiSOAR™ `Attachments` module. If you choose File IRI, then you must specify the following parameter: File IRI: IRI of the file that you want to upload to the specified Slack channels. The File IRI is used to access the file directly from FortiSOAR™.
Comment	(Optional) Initial comment to add to the file that you want to upload to the specified Slack channels.

Output

The JSON output contains details of the file uploaded to the Slack channel that you have specified. File details such as file name, file type, timestamp, groups, and comments count, are included in the JSON output.

The output contains the following populated JSON schema:
{
"file": {
"thumb_360": "",
"thumb_80": "",
"title": "",
"thumb_360_h": "",
"filetype": "",
"url_private": "",
"url_private_download": "",
"permalink_public": "",
"thumb_160": "",
"permalink": "",
"lines_more": "",
"is_public": "",
"mode": "",
"public_url_shared": "",
"display_as_bot": "",
"mimetype": "",
"num_stars": "",
"ims": [],
"timestamp": "",
"created": "",
"size": "",
"pinned_to": [],
"reactions": [
{
"name": "",
"users": [],
"count": ""
}
],
"is_starred": "",
"pretty_type": "",
"editable": "",
"thumb_480_w": "",
"thumb_480_h": "",
"username": "",
"is_external": "",
"groups": [],
"comments_count": "",
"edit_link": "",
"preview": "",
"name": "",
"initial_comment": {},
"thumb_360_gif": "",
"external_type": "",
"user": "",
"lines": "",
"preview_highlight": "",
"thumb_480": "",
"thumb_64": "",
"thumb_360_w": "",
"channels": [],
"id": ""
},
"ok": ""
}

Included playbooks

The Sample - Slack - 3.0.0 playbook collection comes bundled with the Slack connector. This playbook contains steps using which you can perform all supported actions. You can see the bundled playbooks in the Automation > Playbooks section in FortiSOAR™ after importing the Slack connector.

Channel: Close Channel
Channel: Create Channel
Channel: Get Channels Information
Channel: Get Channels List
Channel: Rename Channel
Channel: Search Channel
Message: Get Message History
Message: Send Message
Upload File
User: Get User Information
User: Get User List
User: Invite User To Channel

Note: If you are planning to use any of the sample playbooks in your environment, ensure that you clone those playbooks and move them to a different collection since the sample playbook collection gets deleted during the connector upgrade and delete.

Creating and installing a Slack App in a workspace

IMPORTANT: If you require bi-directional integration between FortiSOAR and Slack, then you must use the app template of FortiSOAR For Slack Application for appropriate permissions. However, if you require to use only the connector actions, then you can initialize the app from a blank template as mentioned in the Creating and installing a Slack App in a workspace topic. Permissions required for each action are listed in the Permissions table in this topic.

Log onto the Slack API site.
Note: You require to sign in to your Slack account to create an application.
Click Create New App.
On the Create an App dialog, select the From Scratch option.
In the Name app & choose workspace dialog, enter the name for your app and choose the workspace for which you creating this app, then click Create App.

Once the app is created, you can view your app's basic information:
Click OAuth & Permissions:
Scroll down to the Scopes section:
Add the Bot Token or User Token scopes based on which token you want to use for your slack connector.
Bot Token (Recommended): Gives permissions to your app.
User Token: Accesses user data and acts on behalf of users that authorize them.

Add all necessary permissions that you want to give to your app and save your changes. The following table lists the permissions required for each action of the connector:

Action Name	Permissions List (Bot Token)	Permissions List (User Token)
Create Channel	admin.conversations:write	admin.conversations:write
Send Message	chat:write	chat:write, chat:write:user, chat:write:bot
Get Message History	channels:history, groups:history, im:history, mpim:history	channels:history, groups:history, im:history, mpim:history
Get Channels List	channels:read, groups:read, im:read, mpim:read	channels:read, groups:read, im:read, mpim:read
Search Channel	channels:read, groups:read, im:read, mpim:read	channels:read, groups:read, im:read, mpim:read
Get Channel Information	channels:read, groups:read, im:read, mpim:read	channels:read, groups:read, im:read, mpim:read
Rename Channel	channels:manage, groups:write, im:write, mpim:write	groups:write, im:write, mpim:write, channels:write
Invite User To Channel	channels:manage, groups:write, im:write, mpim:write	groups:write, im:write, mpim:write, channels:write
Close Channel	channels:manage, groups:write, im:write, mpim:write	groups:write, im:write, mpim:write, channels:write
Get User List	users:read	users:read
Get User Information	users:read	users:read
Upload File	files:write	files:write, files:write:user

Go to Basic Information and click Install to Workspace.
On the following screen, which requests access to your app, click Allow.
Go back to your Slack app configuration screen and click OAuth & Permissions, where you should be able to see the User or Bot User OAuth tokens you have configured, as shown in the following image:

If you do not see the information shown in the above image, contact your admin.
Copy the Bot User OAuth Token or the User OAuth Token that you will use to configure your Slack connector.