> For the complete documentation index, see [llms.txt](https://docs.docontrol.io/docontrol-user-guide/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.docontrol.io/docontrol-user-guide/saas-data-monitoring/content-scans/slack-enterprise-scan.md). # Slack Enterprise scan You can run a content scan to locate specific keywords or phrases in your organization's Slack Enterprise workspace. Scanning your Slack workspace for specific content provides critical visibility into potential data security risks and policy violations that might otherwise go undetected. A content scan can help you to: * Identify inadvertent or malicious sharing of sensitive information, such as PII, credentials, or intellectual property * Detect early indicators of insider threats or compliance breaches * Respond faster and mitigate potential damage {% hint style="success" %} * Make sure your DoControl-Slack integration is for Slack **Enterprise** before running a content scan. * DoControl scans your entire Slack workspace, so the content scan might take some time. Setting a time range helps reduce scan time and limit the amount of data scanned. {% endhint %} ## Create a Slack content scan You can search for a single keyword or phrase when you create a content scan in Slack Enterprise. DoControl will detect Slack conversations containing the keyword or phrase you search for. {% hint style="warning" %} * You can only run one content scan at a time * You need **Admin** permission in DoControl to create, download or delete a content scan * The **maximum** time range for a content scan is any **6 months** from the past {% endhint %} 1. From the DoControl side menu, select **Reports > Content scans > Slack Enterprise.** 2. Click **Create content scan**.

3. Enter the content scan name. 4. Enter the keyword or phrase to search for across your Slack conversations. 5. Select the time range for searching conversations from the last year and click **OK.** \ The **maximum** time range for a content scan is any 6-month period from the past. You can also select any of the following quick timeframe options: * Today * Last 7 days * Last 14 days * Last 31 days * Last 3 months * Last 6 months

6. Click **Save and scan.** ## View **content scans** DoControl displays the results for each content scan in an easy-to-parse table: {% hint style="success" %} The results of content scans are available for downloading up to 90 days after creating the content scan. {% endhint %}

Content scan parameter	Description
Content scan	Name of content scan
Created on	Date and time that content scan was generated
Search term	Scanned keyword or phrase
Status	If the scan has completed or not: Scan in-progress - Scan is running Scan completed - Scan is finished Scan failed - Scan did not complete Scan aborted - Scan was cancelled. A report is not generated for aborted scans.
Matches found	Number of Slack files or Slack conversations found with search terms
Time range	Date range of conversations that were scanned. The range can be a maximum of any 6 months.
Export	Click Export to download the content scan results as a CSV file
Delete	Click the Trash icon to delete a content scan

## Investigate scan results After you click the **Export**

link for a specific content scan, the results are downloaded as a CSV file. {% hint style="success" %} Matches are displayed for message text or attachment names. {% endhint %} The results are displayed in the CSV as follows:

Content scan result	Description
Timestamp	Timestamp of Slack message
Date	Date and time of Slack message
Workspace ID	Unique identifier of Slack Enterprise workspace
Workspace name	Name of workspace
Channel ID	Unique identifier of Slack channel
Channel name	Name of Slack channel
Message	Text of the Slack message that contains the search term
Attachment name	The attachment name that contains the search term
12-hour context window	URL link to a CSV file that contains all Slack messages that occurred in the same channel within a 12-hour window

#### To investigate context for the match: 1. Click the URL in the 12-hour context window. \ Another CSV is downloaded. 2. In the second CSV, view all messages that were sent 6 hours before and 6 hours after the matched message or attachment. --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation by asking a question. Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters: ``` GET https://docs.docontrol.io/docontrol-user-guide/saas-data-monitoring/content-scans/slack-enterprise-scan.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.