> For the complete documentation index, see [llms.txt](https://docs.docontrol.io/docontrol-user-guide/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.docontrol.io/docontrol-user-guide/integrations/slack-enterprise.md). # Slack Enterprise Slack Enterprise is a collaboration solution for large or complex organizations up to 500,000 people, and allows you to connect multiple dedicated workspaces inside your company. DoControl is one of Slack Enterprise's **exclusive DLP partners** and is officially part of the Slack [Discovery program](). With DoControl, you can enable DLP monitoring (data loss prevention) across several Slack Enterprise workspaces simultaneously. After integrating, DoControl monitors Slack files and messages for sensitive information across all Slack conversations in private and public channels and workspaces. DoControl captures audit log and event data in near real-time, and this helps your organization to reduce the risk of data loss before sensitive data is exposed externally. {% hint style="info" %} * To integrate with Slack Enterprise, you need an [Enterprise Grid](https://app.slack.com/plans/) plan. * If your organization uses Slack Enterprise Grid, you can choose what functionality you enable: * For full **Slack Enterprise** capabilities - Integrate with DoControl's [Slack Enterprise ](#integration-steps)module. * For **Slack basic** capabilities - Integrate with DoControl's [Slack](/docontrol-user-guide/integrations/slack.md) module. * You can integrate with only one DoControl capability: Slack or Slack Enterprise. * Asset and user inventory are not displayed for Slack Enterprise (only for Slack). {% endhint %} ## Use cases When you integrate DoControl with Slack Enterprise, you can address these use cases: * **Data loss prevention** ([Discovery program]()) - * Monitor file and message sharing for sensitive data in all conversation types across the grid, within private and public channels. Make sure that scanning direct messages for DLP complies with your organization's privacy policies. * Prevent data sharing with external organizations, and auto-delete files in private channels. * Remediate potential data loss by isolating files or messages in quarantine for further analysis, and then either deleting or restoring them if approved. * **Audit log tracking** - * Verify that users are logging in from a legitimate location or IP address, track these audit events in workflows, and notify if geographic violations occur. For example, the Security team will be notified if a US-based employee logs in from China. * Track audit logs across all workspaces in your Slack Enterprise Grid, and receive near real-time notifications for anomalous audit log events. * Proactively monitor for potential security issues or malicious access attempts. * **DoControl bot messages and notifications** - * When the DoControl app joins your selected channels, members of each channel are notified once. * End users in public channels will receive DoControl bot messages as part of workflows, for example, asking to approve or reject their actions. * To enable end users in private channels to receive automatic notifications, see [Notify in Slack](/docontrol-user-guide/workflows/define-workflow-settings/action-settings/notify.md#notify-in-slack). {% hint style="info" %} * For information how to remediate potential data loss, see [Slack Enterprise remediation](/docontrol-user-guide/workflows/define-workflow-settings/action-settings/remediate/slack-enterprise-remediation.md). * For a sample playbook, see [Prevent PII on Slack Enterprise messages](/docontrol-user-guide/risk-management/threat-model-coverage/external-collaborator-sharing/slack-enterprise-playbooks-for-external-sharing.md#prevent-pii-in-slack-enterprise-messages). {% endhint %} ## Interactive approvals and decisions Receive interactive and dynamic Slack messages for approvals and decisions. The DoControl app allows you to: * Start getting interactive Slack messages for approvals and decisions: * Who approved or decided? * Was it approved or rejected? What was decided? * Respond to approvals and decisions directly in the Slack channel * Easily track your Slack notifications

Interactive Slack messages for approvals and decisions

{% hint style="info" %} * **Existing customers**: To migrate from DoBot to the new DoControl app and start receiving interactive Slack messages, you need to re-integrate DoControl with Slack or [Slack Enterprise](/docontrol-user-guide/integrations/slack-enterprise.md). * Notification settings have moved from Settings to the Slack integration wizard. {% endhint %} ## Prerequisites Before integrating DoControl with Slack Enterprise, make sure the integrator has fulfilled these prerequisites: * **Enterprise Grid** - Your organization must be an Enterprise Grid customer. * **Primary Org Owner** - Only a Primary Org Owner can install DoControl. This account should be created specifically for this purpose, so that DoControl is not tied to a single user. * **Connected to Slack Enterprise** - The Primary Org Owner must be logged into Slack Enterprise before integrating with DoControl. * **DoControl is an approved domain** - In your email provider, define DoControl as an **approved** domain. If you use an email security solution, it will release decision and approval notifications only if DoControl is whitelisted. {% hint style="info" %} If your organization is leveraging only audit log tracking (not DLP), it's enough for the integrator to be an **owner** of Slack Enterprise. {% endhint %} ## Send email to Slack to enable integration To integrate with the Data Loss Prevention (DLP) functionality, your organization owner needs to send an email asking Slack to enable your settings. {% hint style="warning" %} You cannot integrate DoControl with Slack Enterprise if you don't ask Slack to first enable these settings. {% endhint %} #### To ask Slack to enable DLP integration: 1. Your organization **owner** needs to send an email to: `exports@slack.com.` 2. Ask Slack to enable: **Discovery APIs** for your organization 3. After verifying that your email address matches an owner of the organization, Slack will enable access for you to complete the integration. ## Required permission scopes When you integrate DoControl with Slack Enterprise, you can select which functionalities you enable. You can leverage either audit log tracking or data loss prevention, or both. The required permissions scopes vary according to functionality:
Slack Enterprise scopePermission scope in Slack
Audit log tracking
  • auditlogs:read
Data loss prevention (Discovery program)
  • discovery.read
  • discovery.write
  • admin.conversation:read
DoControl bot messages and notifications (mandatory)

  • chat:write
  • chat:write:public
{% hint style="info" %} For more information, see the Slack [audit logs API](https://api.slack.com/admins/audit-logs-call) and [Slack Discovery APIs](https://slack.com/help/articles/360002079527-A-guide-to-Slacks-Discovery-APIs#dlp-2). {% endhint %} ## Slack Enterprise events When you create [workflows](/docontrol-user-guide/workflows/define-workflow-settings/action-settings/remediate/slack-enterprise-remediation.md) for Slack Enterprise DLP or audit log tracking, you need to select a trigger from this specific set of Slack Enterprise events. For more information per event type, click the relevant API link below. {% hint style="success" %} To track the following Slack Enterprise events in near real-time, you need to select **Audit log tracking** when defining your [scopes and permissions ](#select-scopes-and-permissions)in the integration wizard. {% endhint %}
Event typeSlack Enterprise event
Channel events

guest_channel_join

guest_channel_leave

private_channel_created

private_channel_deleted

public_channel_converted_to_private

public_channel_created

public_channel_deleted

private_channel_converted_to_public

user_channel_join

user_channel_leave

User events

anomaly

canvas_downloaded

file_downloaded

guest_created

guest_joined_workspace

list_downloaded

public_channel_preview

role_change_to_admin

user_created

user_logout

user_login

user_joined_workspace

App events

app_approved

app_installed

app_scopes_expanded

bot_token_upgraded

File eventsfile_malicious_content_detected
## Integration steps To integrate DoControl with Slack Enterprise, follow these steps: 1. [Select scopes and permissions](#select-scopes-and-permissions) 2. [Select workspaces](#select-workspaces) 3. [Select conversations ](#select-conversations) 4. [Exclude conversations from monitoring (optional)](#exclude-conversations-from-monitoring-optional) ### Select scopes and permissions {% hint style="info" %} Both Slack Enterprise scopes (DLP and audit log tracking) are selected by default, but you can choose to integrate only one scope if you wish. {% endhint %} 1. From the DoControl side menu, click **Integrations**. 2. Under the Slack Enterprise icon, click **Connect**.\ The Connect to Slack Enterprise wizard opens. 3. Click **Get started**, and follow the instructions in the wizard. 4. For **Scopes and permissions**, select the functional areas you want the integration to cover: * **Data loss prevention (DLP)** - Monitor sensitive data sharing and remediate potential data loss. * **Audit log tracking** - Track near-real time audit log events, and monitor for security issues. * **DoControl bot messages and notifications** - Send messages to users as part of workflows (selected by default).
5. For **Permissions**, make sure Write (remediation) is selected if you want to perform remediation actions in Slack Enterprise. 6. Click **Next**. 7. In the Connections page, click **Connect** for each one of your selected functional scopes.
8. Click **Next**. {% hint style="warning" %} **Troubleshooting**: If DoControl doesn't manage to sync your connections, check that: * You have Primary Owner permissions (for conversation monitoring) or Workspace admin or owner (for DoControl bot messages and notifications). * Your Slack plan is Enterprise Grid (for conversation monitoring) or minimum Slack Pro (for DoControl bot messages and notifications). * You enabled Discovery APIs and DLP file pre-processing by [sending an email](#send-email-to-slack-to-enable-integration-dlp) to Slack. {% endhint %} ### Select workspaces 1. For **Workspaces**, select the following: * All workspaces, or * Selected workspaces
2. **Audit log tracking scope only**: To enter selected workspaces, you first need to locate the workspace ID: * Sign in to your Slack account, and go to your main workspace. * From the URL in your browser, copy the numbers and letters starting with “T”. This represents your workspace ID (e.g. T12345w). * Enter your selected workspace IDs.
3. **Data loss prevention (Discovery) scope**: Type the workspace name and it will auto-complete. Click **Enter** to type multiple workspace IDs.\ \ ![](https://3236294211-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MesrnyDMZGYg1V-tOBo%2Fuploads%2FAWcFQid9VNqb9OAH54Ph%2Fworkspaces.png?alt=media\&token=7766e834-25fc-467a-821c-37e0cce91063) {% hint style="success" %} If you choose **all** workspaces, your monitored data is dynamically updated whenever new workspaces are added. {% endhint %} ### Select conversations If you choose **all** conversations, your monitored data is dynamically updated whenever new conversations are added. 1. For **Conversations**, select the following: * **All conversations** - All internal and external conversations are checked. You can deselect any of these internal and external conversation types: public channels, private channels, or direct messages.
OR * **Selected conversations** - Choose between 1-15 conversations for monitoring file sharing. Start typing the conversation name to auto-complete.
2. Select **Direct messages** if you wish to scan direct messages. {% hint style="warning" %} Make sure that scanning direct messages from internal and external conversations complies with your organization's privacy policies. {% endhint %} ### Exclude conversations from monitoring (optional) The options for excluding conversations from monitoring depend on which [conversations](#select-conversations) you selected: * If you selected **All conversations** - You can exclude specific conversations or users or apps from monitoring for file sharing. These excluded entities won't be monitored for sensitive data.
* If you selected **specific conversations** - You can only exclude specific users or apps.
#### To exclude conversations from monitoring: You can choose between 1-15 conversations to exclude from monitoring. 1. Select the relevant conversation from the dropdown list to exclude from monitoring (only if you selected all conversations). 2. Type the **user name** to exclude specific users from monitoring for file sharing. 3. Type the **app name** to exclude specific apps from monitoring for file sharing.
{% hint style="success" %} * Start typing the user or app name to auto-complete. * Click **Enter** to type multiple user or app names. {% endhint %} 3. Click **Save**. When done, you'll get a Success message that Slack Enterprise is connected. {% hint style="info" %} For information how to remediate potential data loss, see [Slack Enterprise remediation](/docontrol-user-guide/workflows/define-workflow-settings/action-settings/remediate/slack-enterprise-remediation.md). {% endhint %} ## Troubleshooting Q. What happens if my Slack Enterprise token expires? A. If the person who performed the integration leaves your organization, your Slack Enterprise token will expire. You need to reconnect to DoControl by performing the [integration procedure](/docontrol-user-guide/integrations/slack-enterprise.md) again. --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation by asking a question. Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters: ``` GET https://docs.docontrol.io/docontrol-user-guide/integrations/slack-enterprise.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.