> For the complete documentation index, see [llms.txt](https://docs.docontrol.io/docontrol-user-guide/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.docontrol.io/docontrol-user-guide/risk-management/threat-model-coverage/sensitive-data-movement/slack-enterprise-playbooks-for-sensitive-data-movement.md).

# Slack Enterprise playbooks for sensitive data movement

To mitigate the risk associated with sensitive data movement in Slack Enterprise, you can define automated workflows for these use cases: 

* [Detect sensitive patterns in Slack Enterprise external direct messages](#detect-sensitive-patterns-in-slack-enterprise-external-direct-messages)
* [Detect sensitive patterns in Slack Enterprise internal channels](#detect-sensitive-patterns-in-slack-enterprise-internal-channels)
* [Detect sensitive patterns in Slack Enterprise internal direct messages](#detect-sensitive-patterns-in-slack-enterprise-internal-direct-messages)
* [Detect sensitive patterns in Slack Enterprise shared channels](#detect-sensitive-patterns-in-slack-enterprise-shared-channels)
* [Remove PII from Slack Enterprise external direct messages](#remove-pii-from-slack-enterprise-external-direct-messages)
* [Remove PII from Slack Enterprise internal channels](#remove-pii-from-slack-enterprise-internal-channels)
* [Remove PII from Slack Enterprise internal direct messages](#remove-pii-from-slack-enterprise-internal-direct-messages)
* [Scan Slack Enterprise direct messages for sensitive content](#scan-slack-enterprise-direct-messages-for-sensitive-content)

## Detect sensitive patterns in Slack Enterprise external direct messages

When someone sends a message or file as a direct message in an external Slack Enterprise channel, and the file or message contains sensitive regex patterns, both the message and file are quarantined in near real-time for further analysis. If approved, the message and file are restored. If not approved, both the message and file are deleted from Slack Enterprise.

1. In Workflows, select **Playbooks**.
2. Filter the playbooks according to the Slack Enterprise app, and select the **Detect sensitive patterns in Slack Enterprise external direct messages** playbook.
3. Give an action name.<br>

   <figure><img src="https://3236294211-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MesrnyDMZGYg1V-tOBo%2Fuploads%2FELgcgFc50iQutrjQZYP6%2FSE%20detect%20sens%20patt%20external%20PB.png?alt=media&amp;token=ba1a3c5c-9af8-4bca-9dad-6f38940c7512" alt=""><figcaption></figcaption></figure>
4. Under the **Message shared** event, add any relevant conditions.
5. Customize the **Regex scan** to search for sensitive patterns, such as `US medicare health insurance claim (HIC)` in the message and file.
6. Customize a **Conditional** step to check if the message or file contains sensitive data:
   * **False** - If the message or file doesn't contain the regex pattern, customize the **End workflow** step.
   * **True** - If the message or file contains the regex pattern, customize the **Quarantine message** and **Quarantine file** steps.
7. In the **Quarantine message** step, customize the review message which Slack Enterprise displays to users instead of the original message:\
   `This message has been temporarily removed for review by the security team.`
8. In the **Quarantine file** step, any attachment is isolated for security review. Customize the review message which Slack Enterprise displays to users instead of the original file:\
   `This file has been temporarily removed for review by the security team.`
9. Customize the **Approval** step to send a Slack message to the SecOps team asking them to approve the message or file share containing sensitive data:
   * **No** or **Timeout** - If the message or file is not approved, customize the **Delete** **message** and **Delete file** steps. \
     Both the quarantined message and file are permanently removed from Slack Enterprise.
   * **Yes** - If the message or file is approved, customize the **Restore** **message** and **Restore file** steps.\
     Both the quarantined message and file are reinstated in Slack Enterprise.

## Detect sensitive patterns in Slack Enterprise internal channels

When someone sends a message or file in an internal Slack Enterprise channel, and the file or message contains sensitive regex patterns, both the message and file are quarantined in near real-time for further analysis. If approved, the message and file are restored. If not approved, both the message and file are deleted from Slack Enterprise.

1. In Workflows, select **Playbooks**.
2. Filter the playbooks according to the Slack Enterprise app, and select the **Detect sensitive patterns in Slack Enterprise internal channels** playbook.
3. Give an action name.<br>

   <figure><img src="https://3236294211-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MesrnyDMZGYg1V-tOBo%2Fuploads%2FR9s2Xr3JaMVVD8gECI8R%2FSE%20sens%20patt%20internal%20PB.png?alt=media&amp;token=0a6aa1de-c87d-4c9b-8dc7-4703030bec46" alt=""><figcaption></figcaption></figure>
4. Under the **Message shared** event, add any relevant conditions.
5. Customize the **Regex scan** to search for sensitive patterns, such as `social security number (SSN)` in the message and file.
6. Customize a **Conditional** step to check if the message or file contains sensitive data:
   * **False** - If the message or file doesn't contain the regex pattern, customize the **End workflow** step.
   * **True** - If the message or file contains the regex pattern, customize the **Quarantine message** and **Quarantine file** steps.
7. In the **Quarantine message** step, customize the review message which Slack Enterprise displays to users instead of the original message:\
   `This message has been temporarily removed for review by the security team.`
8. In the **Quarantine file** step, any attachment is isolated for security review. Customize the review message which Slack Enterprise displays to users instead of the original file:\
   `This file has been temporarily removed for review by the security team.`
9. Customize the **Approval** step to send a Slack message to the SecOps team asking them to approve the message or file share containing sensitive data:
   * **No** or **Timeout** - If the message or file is not approved, customize the **Delete** **message** and **Delete file** steps. \
     Both the quarantined message and file are permanently removed from Slack Enterprise.
   * **Yes** - If the message or file is approved, customize the **Restore** **message** and **Restore file** steps.\
     Both the quarantined message and file are reinstated in Slack Enterprise.

## Detect sensitive patterns in Slack Enterprise internal direct messages

When someone sends a message or file as a direct message in an internal Slack Enterprise channel, and the file or message contains sensitive regex patterns, both the message and file are quarantined in near real-time for further analysis. If approved, the message and file are restored. If not approved, both the message and file are deleted from Slack Enterprise.

1. In Workflows, select **Playbooks**.
2. Filter the playbooks according to the Slack Enterprise app, and select the **Detect sensitive patterns in Slack Enterprise internal direct messages** playbook.
3. Give an action name.<br>

   <figure><img src="https://3236294211-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MesrnyDMZGYg1V-tOBo%2Fuploads%2Fhnn7g2o6JImKC9g4l7c6%2FSE%20detect%20sens%20patt%20DM%20internal%20PB.png?alt=media&amp;token=fd4b1c3b-2f59-4b53-be01-d218c574a5e6" alt=""><figcaption></figcaption></figure>
4. Under the **Message shared** event, add any relevant conditions.
5. Customize the **Regex scan** to search for sensitive patterns, such as `social security number (SSN)` in the message and file.
6. Customize a **Conditional** step to check if the message or file contains sensitive data:
   * **False** - If the message or file doesn't contain the regex pattern, customize the **End workflow** step.
   * **True** - If the message or file contains the regex pattern, customize the **Quarantine message** and **Quarantine file** steps.
7. In the **Quarantine message** step, customize the review message which Slack Enterprise displays to users instead of the original message:\
   `This message has been temporarily removed for review by the security team.`
8. In the **Quarantine file** step, any attachment is isolated for security review. Customize the review message which Slack Enterprise displays to users instead of the original file:\
   `This file has been temporarily removed for review by the security team.`
9. Customize the **Approval** step to send a Slack message to the SecOps team asking them to approve the message or file share containing sensitive data:
   * **No** or **Timeout** - If the message or file is not approved, customize the **Delete** **message** and **Delete file** steps. \
     Both the quarantined message and file are permanently removed from Slack Enterprise.
   * **Yes** - If the message or file is approved, customize the **Restore** **message** and **Restore file** steps.\
     Both the quarantined message and file are reinstated in Slack Enterprise.

## Detect sensitive patterns in Slack Enterprise shared channels

When someone sends a message or file in a shared Slack Enterprise channel, and the file or message contains sensitive regex patterns, both the message and file are quarantined in near real-time for further analysis. If approved, the message and file are restored. If not approved, both the message and file are deleted from Slack Enterprise.

1. In Workflows, select **Playbooks**.
2. Filter the playbooks according to the Slack Enterprise app, and select the **Detect sensitive patterns in Slack Enterprise shared channels** playbook.
3. Give an action name.<br>

   <figure><img src="https://3236294211-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MesrnyDMZGYg1V-tOBo%2Fuploads%2FphFr55fbDbJLCnhLEbLs%2FSE%20detect%20sens%20patt%20shared%20PB.png?alt=media&amp;token=96792097-636a-4d53-af76-257a04cfe59d" alt=""><figcaption></figcaption></figure>
4. Under the **Message shared** event, add any relevant conditions.
5. Customize the **Regex scan** to search for sensitive patterns, such as `US medicare health insurance claim (HIC)` in the message and file.
6. Customize a **Conditional** step to check if the message or file contains sensitive data:
   * **False** - If the message or file doesn't contain the regex pattern, customize the **End workflow** step.
   * **True** - If the message or file contains the regex pattern, customize the **Quarantine message** and **Quarantine file** steps.
7. In the **Quarantine message** step, customize the review message which Slack Enterprise displays to users instead of the original message:\
   `This message has been temporarily removed for review by the security team.`
8. In the **Quarantine file** step, any attachment is isolated for security review. Customize the review message which Slack Enterprise displays to users instead of the original file:\
   `This file has been temporarily removed for review by the security team.`
9. Customize the **Approval** step to send a Slack message to the SecOps team asking them to approve the message or file share containing sensitive data:
   * **No** or **Timeout** - If the message or file is not approved, customize the **Delete** **message** and **Delete file** steps. \
     Both the quarantined message and file are permanently removed from Slack Enterprise.
   * **Yes** - If the message or file is approved, customize the **Restore** **message** and **Restore file** steps.\
     Both the quarantined message and file are reinstated in Slack Enterprise.

## Remove PII from Slack Enterprise external direct messages

When someone sends a message or file as a direct message in an external Slack Enterprise channel, and the file or message contains PII (personally identifiable information), both the message and file are quarantined in near real-time for further analysis. If approved, the message and file are restored. If not approved, both the message and file are deleted from Slack Enterprise.

1. In Workflows, select **Playbooks**.
2. Filter the playbooks according to the Slack Enterprise app, and select the **Remove PII from Slack Enterprise external direct messages** playbook.
3. Give an action name.<br>

   <figure><img src="https://3236294211-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MesrnyDMZGYg1V-tOBo%2Fuploads%2FfZUJVBVwddCvblDsYSJE%2FSE%20prevent%20PII%20external%20DM%20PB.png?alt=media&amp;token=6c35f4b8-af25-4214-a005-93d5ed1af453" alt=""><figcaption></figcaption></figure>
4. Under the **Message shared** event, add any relevant conditions.
5. Customize the **PII scan** to search for PII labels, such as `bank account number` or `SSN` in the message and file.
6. Customize a **Conditional** step to check if the message or file contains PII with a probability higher than 70%:
   * **False** - If the message or file doesn't contain PII, customize the **End workflow** step.
   * **True** - If the message or file contains PII, customize the **Quarantine message** and **Quarantine file** steps.
7. In the **Quarantine message** step, customize the review message which Slack Enterprise displays to users instead of the original message:\
   `This message has been temporarily removed for review by the security team.`
8. In the **Quarantine file** step, any attachment is isolated for security review. Customize the review message which Slack Enterprise displays to users instead of the original file:\
   `This file has been temporarily removed for review by the security team.`
9. Customize the **Approval** step to send a Slack message to the SecOps team asking them to approve the message or file share containing PII:
   * **No** or **Timeout** - If the message or file is not approved, customize the **Delete** **message** and **Delete file** steps. \
     Both the quarantined message and file are permanently removed from Slack Enterprise.
   * **Yes** - If the message or file is approved, customize the **Restore** **message** and **Restore file** steps.\
     Both the quarantined message and file are reinstated in Slack Enterprise.

## Remove PII from Slack Enterprise internal channels

When someone sends a message or file in an internal Slack Enterprise channel, and the file or message contains PII (personally identifiable information), both the message and file are quarantined in near real-time for further analysis. If approved, the message and file are restored. If not approved, both the message and file are deleted from Slack Enterprise.

1. In Workflows, select **Playbooks**.
2. Filter the playbooks according to the Slack Enterprise app, and select the **Remove PII from Slack Enterprise internal channels** playbook.
3. Give an action name.<br>

   <figure><img src="https://3236294211-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MesrnyDMZGYg1V-tOBo%2Fuploads%2F8urzYXXOnNOqLH9JyKGY%2FPrevent%20PII%20SE%20internal%20PB.png?alt=media&amp;token=55a3d8eb-370c-45b9-aba4-d6a00b2334c7" alt=""><figcaption></figcaption></figure>
4. Under the **Message shared** event, add any relevant conditions.
5. Customize the **PII scan** to search for PII labels, such as `bank account number` or `SSN` in the message and file.
6. Customize a **Conditional** step to check if the message or file contains PII with a probability higher than 70%:
   * **False** - If the message or file doesn't contain PII, customize the **End workflow** step.
   * **True** - If the message or file contains PII, customize the **Quarantine message** and **Quarantine file** steps.
7. In the **Quarantine message** step, customize the review message which Slack Enterprise displays to users instead of the original message:\
   `This message has been temporarily removed for review by the security team.`
8. In the **Quarantine file** step, any attachment is isolated for security review. Customize the review message which Slack Enterprise displays to users instead of the original file:\
   `This file has been temporarily removed for review by the security team.`
9. Customize the **Approval** step to send a Slack message to the SecOps team asking them to approve the message or file share containing PII:
   * **No** or **Timeout** - If the message or file is not approved, customize the **Delete** **message** and **Delete file** steps. \
     Both the quarantined message and file are permanently removed from Slack Enterprise.
   * **Yes** - If the message or file is approved, customize the **Restore** **message** and **Restore file** steps.\
     Both the quarantined message and file are reinstated in Slack Enterprise.

## Remove PII from Slack Enterprise internal direct messages

When someone sends a message or file as a direct message in an internal Slack Enterprise channel, and the file or message contains PII (personally identifiable information), both the message and file are quarantined in near real-time for further analysis. If approved, the message and file are restored. If not approved, both the message and file are deleted from Slack Enterprise.

1. In Workflows, select **Playbooks**.
2. Filter the playbooks according to the Slack Enterprise app, and select the **Remove PII from Slack Enterprise internal direct messages** playbook.
3. Give an action name.<br>

   <figure><img src="https://3236294211-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MesrnyDMZGYg1V-tOBo%2Fuploads%2FXZzqtPOYcabcj7WdTKEN%2FPrevent%20PII%20in%20SE%20internal%20DMs%20PB.png?alt=media&amp;token=3a3ca2ac-a94e-4c9e-84a2-b66501b443f8" alt=""><figcaption></figcaption></figure>
4. Under the **Message shared** event, add any relevant conditions.
5. Customize the **PII scan** to search for PII labels, such as `bank account number` or `SSN` in the message and file..
6. Customize a **Conditional** step to check if the message or file contains PII with a probability higher than 70%:
   * **False** - If the message or file doesn't contain PII, customize the **End workflow** step.
   * **True** - If the message or file contains PII, customize the **Quarantine message** and **Quarantine file** steps.
7. In the **Quarantine message** step, customize the review message which Slack Enterprise displays to users instead of the original message:\
   `This message has been temporarily removed for review by the security team.`
8. In the **Quarantine file** step, any attachment is isolated for security review. Customize the review message which Slack Enterprise displays to users instead of the original file:\
   `This file has been temporarily removed for review by the security team.`
9. Customize the **Approval** step to send a Slack message to the SecOps team asking them to approve the message or file share containing PII:
   * **No** or **Timeout** - If the message or file is not approved, customize the **Delete** **message** and **Delete file** steps. \
     Both the quarantined message and file are permanently removed from Slack Enterprise.
   * **Yes** - If the message or file is approved, customize the **Restore** **message** and **Restore file** steps.\
     Both the quarantined message and file are reinstated in Slack Enterprise.

## Scan Slack Enterprise direct messages for sensitive content

When someone sends a message or file as a direct message in an internal Slack Enterprise channel, and the file or message contains data classifiers or regex patterns, both the message and file are quarantined in near real-time for further analysis. If approved, the message and file are restored.

1. In Workflows, select **Playbooks**.
2. Filter the playbooks according to the Slack Enterprise app, and select the **Scan Slack Enterprise direct messages for sensitive content** playbook.
3. Give an action name.<br>

   <figure><img src="https://3236294211-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MesrnyDMZGYg1V-tOBo%2Fuploads%2FeTaiiknyYSDkekC6ykNY%2FScan%20Slack%20Ent%20sensitive%20content.png?alt=media&amp;token=a2aab5e2-3428-47a7-a9cb-1ea06eaaf7d3" alt=""><figcaption></figcaption></figure>
4. Under the **Message shared** event, add any relevant conditions:
   * Direct message is **True**
   * Conversation shared is **False**
5. Customize the **Data scan** to search for data classifiers or regex patterns, such as an Amazon Marketplace token, in the message and file.
6. Customize a **Conditional** step to validate if a high-probability match (above 70%) is found in the message:
   * **False** - If the message or file doesn't contain a high-probability match, customize the **End workflow** step.
   * **True** - If the message or file contains a high-probability match, customize the **Quarantine message** step.
7. In the **Quarantine message** step, customize the review message which Slack Enterprise displays to users instead of the original message:\
   `This message has been temporarily removed for review by the security team.`
8. In the **Quarantine file** step, any attachment is isolated for security review. Customize the review message which Slack Enterprise displays to users instead of the original file:\
   `This file has been temporarily removed for review by the security team.`
9. Customize the **Approval** step to send a Slack message to the SecOps team asking them to approve sharing a message that contains sensitive data:
   * **No** or **Timeout** - If the file sharing is not approved, customize the **End workflow** step.&#x20;
   * **Yes** - If the message sharing is approved, customize the **Restore** **message** and **Restore file** steps.\
     Both the quarantined message and file are reinstated in Slack Enterprise.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://docs.docontrol.io/docontrol-user-guide/risk-management/threat-model-coverage/sensitive-data-movement/slack-enterprise-playbooks-for-sensitive-data-movement.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.