> For the complete documentation index, see [llms.txt](https://docs.docontrol.io/docontrol-user-guide/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.docontrol.io/docontrol-user-guide/workflows/define-workflow-settings/action-settings/remediate/slack-enterprise-remediation.md).

# Slack Enterprise remediation

After integrating with Slack Enterprise, DoControl monitors Slack files and messages for sensitive information or PII (personally identifiable information) in all conversation types across the grid, including public and private channels.

DoControl is one of Slack Enterprise's exclusive DLP partners and is officially part of the Slack [Discovery program](<https://slack.com/help/articles/360002079527-A-guide-to-Slacks-Discovery-APIs#dlp-1 >). With DoControl, you can enable DLP (data loss prevention) across several Slack workspaces simultaneously.

{% hint style="info" %}
To integrate DoControl with Slack Enterprise, see [Slack Enterprise integration](/docontrol-user-guide/integrations/slack-enterprise.md).
{% endhint %}

DoControl remediation actions help you to reduce the risk of potential data loss that arises from sharing confidential, malicious, or personally identifiable content with people from external organizations.&#x20;

To prevent potential data loss from shared Slack Enterprise files and messages, you can leverage automated workflows with these remediation actions:

![](https://3236294211-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MesrnyDMZGYg1V-tOBo%2Fuploads%2FUNwnLkjesZm0GWqVGSDq%2FSlack%20Ent%20remed%20actions.png?alt=media\&token=158372af-8d13-4031-94ba-e06956a3fade)

<table><thead><tr><th width="319">Slack Enterprise remediation action</th><th>Description</th></tr></thead><tbody><tr><td><a href="#quarantine-file">Quarantine file</a></td><td>Isolates a file so it cannot be accessed in Slack Enterprise. A message is displayed instead of the file.</td></tr><tr><td><a href="#restore-file">Restore file</a></td><td>Makes a quarantined file accessible again in Slack Enterprise. You cannot restore a deleted file.</td></tr><tr><td><a href="#delete-file">Delete file</a></td><td>Removes a file from Slack Enterprise.</td></tr><tr><td><a href="#quarantine-message">Quarantine message</a></td><td>Isolates a message so it cannot be accessed in Slack Enterprise. A masking message is displayed instead.</td></tr><tr><td><a href="#restore-message">Restore message</a></td><td>Makes a quarantined message accessible again in Slack Enterprise. You cannot restore a deleted message.</td></tr><tr><td><a href="#delete-message">Delete message</a></td><td>Removes a Slack message from Slack Enterprise.</td></tr></tbody></table>

{% hint style="warning" %}

* DoControl deletes Slack files in near-real time.
* After you delete a Slack file, it's permanently deleted and cannot be recovered or restored.
  {% endhint %}

## Quarantine file

When a member of your organization sends a file that contains PII or sensitive information, based on the steps and conditions you defined in workflows, you can remove access to the file and place it in "quarantine" or isolation, where it cannot be accessed by your users.

Instead of the file, a message is displayed to users in Slack informing them that the file has been quarantined.

After a file is quarantined, you can either permanently [delete](#delete-file) or [restore](#restore-file) it.&#x20;

#### To quarantine one or multiple Slack files:

1. In your workflow, define a trigger related to Slack Enterprise; for example, a file that was shared.<br>

   <figure><img src="https://3236294211-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MesrnyDMZGYg1V-tOBo%2Fuploads%2FRN6k9aCRnNUWHimkFwB3%2Fquarantine%20Slack%20file.png?alt=media&amp;token=53038fcf-8bfd-4ff3-923d-2431fb033aac" alt=""><figcaption></figcaption></figure>
2. Add any relevant conditions, such as the file ID.
3. Add the **PII file scan** action.
4. Customize a **Conditional** step to check if the PII scan contains personal information, such as credit card details:
   * If the PII scan doesn't find personal information, add the **End workflow** step.
   * If the PII scan contains personal information, add a **Quarantine file** step.
5. Customize the review message, which Slack will display to users instead of the file.
6. After Quarantine, customize the **Approval** step:
   * If the file is not approved, customize the **Delete** **file** step. \
     The file is permanently removed from Slack.
   * If the file is approved, customize the **Restore file** step.\
     The file is reinstated with its contents in Slack.

## Restore file

After you quarantine a file in Slack Enterprise, you can reinstate it after a waiting period or approval process.  &#x20;

{% hint style="warning" %}
You cannot restore a deleted file.
{% endhint %}

#### To restore one or multiple files in Slack Enterprise:

1. In your workflow, define a trigger related to Slack Enterprise; for example, a file that was shared.<br>

   <figure><img src="https://3236294211-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MesrnyDMZGYg1V-tOBo%2Fuploads%2FPTsMg1EyprzyHYIe2g3H%2FSlack%20Ent%20restore%20file.png?alt=media&amp;token=b9af654c-44a0-47cc-aeac-ec2e3173d852" alt=""><figcaption></figcaption></figure>

2. Add any relevant conditions, such as the user is a specific string.

3. Customize the **Quarantine file** step with a quarantine message that's displayed to all users instead of the file.

4. Customize the review message, which Slack will display to users instead of the file.

5. After Quarantine, customize the **Wait** step.

6. Customize an **Approval** step to ask the user's manager if the file share is approved or not:
   * If the share is not approved, customize the **End workflow** step.&#x20;
   * If the share is approved, customize the **Restore** **file** step.\
     The file is reinstated with its contents in Slack.

## Delete file

You can implement a remediation action in automated workflows to delete specific Slack Enterprise files that pose a security or data exposure risk to your organization.

#### To delete one or multiple Slack files:

1. In your workflow, define a trigger related to Slack Enterprise; for example, a file that was shared.
2. Add any relevant conditions, such as if the file contains an encryption key from the default lexical list.
3. Add any relevant **Notify** action to send a message to the relevant team.
4. From the Actions pane, select **Remediate > Slack Enterprise > Delete file**.
5. Use the automatically-populated `Asset ID` field or add a macro.\
   The specified Slack files are deleted.

<div align="left"><figure><img src="https://3236294211-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MesrnyDMZGYg1V-tOBo%2Fuploads%2FLkGMtOU9unoAvPFx2HYy%2FSlack%20Ent%20delete%20file.png?alt=media&amp;token=f12ea41e-67a3-4c1a-ac17-d259adaa7119" alt=""><figcaption><p>Defining a workflow with a remediation action to automatically delete a Slack Enterprise file containing credit card information</p></figcaption></figure></div>

## Quarantine message

When a member of your organization sends a message that contains PII or sensitive information, based on the steps and conditions you defined in workflows, you can remove access to the message and place it in "quarantine" or isolation, where it cannot be accessed by your users.

Instead of the message, a masking message is displayed to Slack Enterprise users informing them that the message has been quarantined.

After a message is quarantined, you can either permanently [delete](#delete-message) or [restore](#restore-message) it.&#x20;

#### To quarantine one or multiple Slack messages:

1. In your workflow, define a trigger related to Slack Enterprise; for example, a message that was shared.<br>

   <figure><img src="https://3236294211-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MesrnyDMZGYg1V-tOBo%2Fuploads%2FiReDj8xZgjHhMv50m5P7%2Fquarantine%20message%20User.png?alt=media&amp;token=66d2f569-c96d-4a3b-836e-541f7310f487" alt=""><figcaption><p>A workflow with a remediation action to automatically quarantine a Slack Enterprise message with credit card information</p></figcaption></figure>
2. Add the **PII scan** action.
3. Customize a **Conditional** step to check if the PII scan contains personal information, such as credit card details:
   * If the PII scan doesn't find personal information, add the **End workflow** step.
   * If the PII scan contains personal information, add a **Quarantine** **message** step.
4. Customize the review message, which Slack will display to users instead of the original message:\
   `This message has been temporarily removed for review by the security team.`
5. Customize the **Approval** step:
   * If the message is not approved, customize the **Delete** **message** step. \
     The message is permanently removed from Slack.
   * If the message is approved, customize the **Restore** **message** step.\
     The message is reinstated in Slack.

## Restore message

After you quarantine a message in Slack Enterprise, you can reinstate it after a waiting period or approval process.  &#x20;

{% hint style="warning" %}
You cannot restore a deleted message.
{% endhint %}

#### To restore one or multiple messages in Slack Enterprise:

1. In your workflow, define a trigger related to Slack Enterprise; for example, a message that was shared.<br>

   <figure><img src="https://3236294211-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MesrnyDMZGYg1V-tOBo%2Fuploads%2FF12b0wX2EB2j4U6Fkg78%2Frestore%20Slack%20message.png?alt=media&amp;token=5691ab96-76b8-444a-956e-2b28f1da13a2" alt=""><figcaption></figcaption></figure>

2. Add any relevant conditions, such as the user is a specific string.

3. Customize the **Quarantine message** step with a quarantine message that's displayed to all users instead of the original message.

4. After Quarantine, customize the **Wait** step.

5. Customize an **Approval** step to ask the user's manager if the message share is approved or not:
   * If the share is not approved, customize the **End workflow** step.&#x20;
   * If the share is approved, customize the **Restore** **message** step.\
     The message is reinstated in Slack.

## Delete message

You can implement a remediation action in automated workflows to delete specific Slack Enterprise messages that pose a security or data exposure risk to your organization.

#### To delete one or multiple Slack messages:

1. In your workflow, define a trigger related to Slack Enterprise; for example, a message that was shared.
2. Add the **PII scan** action.
3. Customize a **Conditional** step to check if the PII scan contains personal information, such as credit card details:
   * If the PII scan doesn't find personal information, add the **End workflow** step.
   * If the PII scan contains personal information, add a **Notify in Slack** step.
4. Customize the **Notify in Slack** step to send a message to the security team.
5. Customize the **Wait** action: the interval between notifying the security team and deleting the message.
6. From the Actions pane, select **Remediate > Slack Enterprise > Delete message**.
7. Use the automatically-populated `Get message ID` macro.\
   The specified Slack messages are deleted.

<div align="left"><figure><img src="https://3236294211-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MesrnyDMZGYg1V-tOBo%2Fuploads%2FqQmWF2MYfEBmXP2Xjil6%2FDelete%20Slack%20message.png?alt=media&amp;token=5284de9b-c762-4632-a4b1-f88c639d5a6c" alt=""><figcaption><p>Defining a workflow with a remediation action to automatically delete a Slack Enterprise message containing credit card information</p></figcaption></figure></div>


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://docs.docontrol.io/docontrol-user-guide/workflows/define-workflow-settings/action-settings/remediate/slack-enterprise-remediation.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.