> For the complete documentation index, see [llms.txt](https://docs.docontrol.io/docontrol-user-guide/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.docontrol.io/docontrol-user-guide/risk-management/threat-model-coverage/encryption-key-sharing/slack-enterprise-playbooks-for-encryption-key-sharing.md).

# Slack Enterprise playbooks for encryption key sharing

DoControl allows you to easily implement automated workflows that quarantine or delete encryption keys when they are uploaded to channels in Slack Enterprise. 

* [Remediate encryption key sharing in Slack Enterprise files](#remediate-encryption-key-sharing-in-slack-enterprise-files)
* [Quarantine shared encryption key before deleting](#quarantine-shared-encryption-key-before-deleting)

## Remediate encryption key sharing in Slack Enterprise files

When a file is uploaded in a Slack message, DoControl scans the content for encryption keys. If an encryption key is found, the file is deleted, and both the SecOps team and user are notified by Slack.

{% hint style="warning" %}
These files are permanently deleted in in near real-time and cannot be recovered.
{% endhint %}

1. Filter the playbooks according to Encryption key sharing, and select the **Remediate encryption key sharing in Slack Enterprise files** playbook.
2. Under the **Message shared** trigger, the condition is already populated:\
   `Asset type supports scanning`<br>

   <figure><img src="https://3236294211-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MesrnyDMZGYg1V-tOBo%2Fuploads%2FEERnmUrtk04LFmu9UQWY%2FPrevent%20encryption%20key%20sharing%20in%20Slack%20Ent.png?alt=media&amp;token=ba103d9e-804e-401f-b3d3-ff352a733301" alt=""><figcaption></figcaption></figure>
3. Add any relevant conditions.
4. The **Regex scan** action is pre-populated to scan file content for encryption keys:
   * **Scan entity** - File entity selected for scanning
   * **Lexical list or patterns** - Scans for cryptographic private key
   * **Error handling** - Select how to continue in case of an error
5. The **Conditional** step is pre-populated to verify if file contains cryptographic key patterns:
   * If **false** - Workflow ends with success status
   * If **true** - The **Delete file** action automatically deletes any files containing regex patterns for cryptographic private keys.
6. Customize the **Notify in Slack** step to send a message to the SecOps team that a user shared an encryption key file in a Slack channel, and that the file was deleted.
7. Customize the **Notify in Slack** step to send a message to the user that they shared an encryption key file in a Slack channel, and that the file was deleted.

## Quarantine shared encryption key before deleting

When files are uploaded in a Slack message and an encryption key is detected, DoControl automatically quarantines all files. If the SecOps team approves the file sharing, all quarantined files are restored to the Slack conversation. If the SecOps team doesn't approve, the files are deleted.

{% hint style="warning" %}

* **All** quarantined files are either deleted or restored, including the encryption key file.
* After deleting, these files are permanently deleted and cannot be recovered.
  {% endhint %}

1. Filter the playbooks according to Encryption key sharing, and select the **Quarantine shared encryption key before deleting** playbook.
2. Under the **Message shared** trigger, the condition is already populated:\
   `Asset type is encryption key`<br>

   <figure><img src="https://3236294211-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MesrnyDMZGYg1V-tOBo%2Fuploads%2FXCJPJoMPHc1CteBzFu7j%2Fquarantine%20shared%20encryption%20key.png?alt=media&amp;token=c2d418ca-aba2-4d13-9878-17c36d4fb052" alt=""><figcaption></figcaption></figure>
3. Add any recommended conditions.
4. The **Quarantine file** step is pre-populated to isolate all files for security examination. You can customize the masking message that's displayed instead of the files.
5. Customize the **Approval** step to ask the SecOps team to approve or reject the file sharing that includes an encryption key:
   * **No** or **timeout** - The quarantined files are automatically deleted
   * **Yes** - The quarantined files are automatically restored


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://docs.docontrol.io/docontrol-user-guide/risk-management/threat-model-coverage/encryption-key-sharing/slack-enterprise-playbooks-for-encryption-key-sharing.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.