> For the complete documentation index, see [llms.txt](https://docs.dropzone.ai/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.dropzone.ai/integrations/tools/slack-chatops.md).

# Slack Chatops

## Slack ChatOps

{% hint style="info" %}
This document is intended for both internal teams and customers. It explains how to set up and use the Slack ChatOps integration in Dropzone, including:

* Command usage
* Authentication flow
* Technical setup steps
  {% endhint %}

The Slack ChatOps feature enables users to perform investigation management actions directly from Slack, such as:

* Approving investigations
* Reopening investigations
* Changing investigation outcomes

### Using Slash Commands

{% hint style="info" %}
Commands cannot currently be executed inside Slack threads. Commands cannot be triggered via emoji reactions (planned for v2).
{% endhint %}

Run one of the following slash commands:

| v0 (Beta) Slash Commands                                            | Description                                         | Example                                                            |
| ------------------------------------------------------------------- | --------------------------------------------------- | ------------------------------------------------------------------ |
| `/dzapprove [INVESTIGATION_ID]`                                     | Approve an investigation by ID                      | `/dzapprove 1012`                                                  |
| `/dzreopen [INVESTIGATION_ID]`                                      | Reopen a previously closed investigation            | `/dzreopen 1012`                                                   |
| `/dzoutcome [INVESTIGATION_ID] [OUTCOME] [NOTES] [--learning_flag]` | Change outcome with note and optional learning flag | `/dzoutcome 1012 malicious Confirmed phishing attempt. --no-learn` |
| `/dzhelp`                                                           | Display usage information                           | `/dzhelp`                                                          |

When you run a slash command, the following authentication process occurs:

1. Slack sends a slash command request to the Dropzone endpoint
2. The Dropzone backend verifies the request using the Signing Secret

* If the Signing Secret is incorrect:
  * The request is rejected
  * The user receives an error from Slack’s built-in Slackbot (not the Dropzone bot)
* If verification succeeds:
  * Dropzone matches the Slack user’s email address to an existing Dropzone tenant user. The user must have previously logged into the Dropzone tenant for them to be found
* If no user match is found:
  * The command fails with an authentication error

3. Successful commands will post a confirmation message visible to everyone in the channel

Progress messages and usage tips are `ephemeral` (visible only to the user).

### Integration Overview

To enable these integrations you will perform the following actions:

* Create and install a Slack Application with the necessary permissions
* Obtain an Application and Slack Token
* Install the credentials into your Dropzone tenant

Before setting up ChatOps, you must have Administrative access to your Dropzone tenant and the organization's Slack workspace

## Create a Slack Application

* Navigate to <https://api.slack.com/apps>
* Click "Create New App"
* Select "From a manifest"

<figure><img src="/files/4wI70W1U0Nm2t7npsxu6" alt=""><figcaption><p>Select "From a Manifest"</p></figcaption></figure>

* Input the following JSON manifest, replacing `<TENANT>` in the manifest with your Dropzone tenant hostname.

```
json
{
  "display_information": {
    "name": "DropzoneAI-ChatOps",
    "description": "Manage investigations via Slack",
    "background_color": "#000000"
  },
  "features": {
    "bot_user": {
      "display_name": "DropzoneAI-ChatOps",
      "always_online": true
    },
    "slash_commands": [
      {
        "command": "/dzapprove",
        "url": "https://<TENANT>.dropzone.app/app/api/chatops/slack/approve",
        "description": "Approve an investigation",
        "usage_hint": "[id]",
        "should_escape": false
      },
      {
        "command": "/dzreopen",
        "url": "https://<TENANT>.dropzone.app/app/api/chatops/slack/reopen",
        "description": "Reopen an investigation",
        "usage_hint": "[id]",
        "should_escape": false
      },
      {
        "command": "/dzoutcome",
        "url": "https://<TENANT>.dropzone.app/app/api/chatops/slack/outcome",
        "description": "Change an investigation outcome",
        "usage_hint": "[id] [outcome] [note] [optional: --no-learn]",
        "should_escape": false
      },
      {
        "command": "/dzhelp",
        "url": "https://<TENANT>.dropzone.app/app/api/chatops/slack/help",
        "description": "Usage information for Dropzone AI slash commands",
        "should_escape": false
      }
    ]
  },
  "oauth_config": {
    "scopes": {
      "bot": ["chat:write", "commands", "users:read", "users:read.email"]
    }
  },
  "settings": {
    "org_deploy_enabled": false,
    "socket_mode_enabled": false,
    "token_rotation_enabled": false
  }
}
```

<figure><img src="/files/bVGbKwOWKsMVeEgfsqZN" alt=""><figcaption><p>Input the manifest</p></figcaption></figure>

* Select your workspace, then click "Next"

<figure><img src="/files/HwaT4c88Fr6xNQHASOSY" alt=""><figcaption></figcaption></figure>

* Click "Create & Install"
* In the settings page for your Dropzone SlackBot application, navigate to "Basic Information"

<figure><img src="/files/WpN8PeB8UBhKX2rgupsL" alt=""><figcaption><p>Navigate to "Basic Information"</p></figcaption></figure>

* Scroll down to "Display Information"

<figure><img src="/files/gwNdgVHYLVEUwykITvYz" alt=""><figcaption><p>Navigate to "Display Information"</p></figcaption></figure>

* Change the App name to something you will remember, such as "DropzoneAI"

{% hint style="info" %}
Should you wish, we've provided Dropzone icons that you can use here: [transparent](https://go.dropzone.ai/img/logos/logomark-transparent-color.png), [white background](https://go.dropzone.ai/img/logos/logomark-blue-on-white.png), or [black background](https://go.dropzone.ai/img/logos/logomark-blue-on-black.png)
{% endhint %}

* At the bottom, click "Save Changes"

You must install the Slack Application to your organization before it can be used. To do so, do the following:

* Navigate to Settings > Install App

<figure><img src="/files/mj4fMCk9z1L2vJagquQJ" alt=""><figcaption><p>Navigate to "Install App"</p></figcaption></figure>

* Click "Install to \[your workspace name]"
* To grant the application permission to access the workspace, click "Allow"

<figure><img src="/files/0Thcg43LonIzc08d5lT8" alt=""><figcaption><p>Click "Allow"</p></figcaption></figure>

This automatically configures:

* Slash commands
* Bot scopes

### Create API Tokens

Slack ChatOps requires two tokens: a Signing Secret and a Bot token (`xoxb-*`)

To obtain your Signing Secret, do the following:

* In the newly created application, navigate to Settings > Basic Information
* In the App Credentials section, copy the Signing Secret shown for use later in the Dropzone UI where it is called "Slack Signing Secret"

To obtain a Bot token, do the following:

* Navigate to Settings > Install App
* Copy the value under "Bot User Auth Token" for use later in the Dropzone UI where it is called "Slack Bot Token"

<figure><img src="/files/G1uGBtwNMuSrwTWueBQA" alt=""><figcaption><p>Copy the Bot token</p></figcaption></figure>

* Alternatively, navigate to Features > OAuth & Permissions, and locate the token there

### Add Credentials to Dropzone

To enable Slack ChatOps, do the following:

* Navigate to your Dropzone AI tenant home page e.g. https\://*mycompany*.dropzone.app
* In the bottom left hand corner, navigate to Settings > System Info
* In the "ChatOps Configuration" section, input the Signing Secret and Bot Token copied earlier

{% hint style="info" %}
In future versions, this configuration will likely move to the Integrations page under a dedicated Slack ChatOps section.
{% endhint %}

### Best Practices

* Include slash command usage tips in your default Slack response templates
* Limit Slack channel access to approved users who are logged into Dropzone
* Ensure that only users with `Member` or `Admin` roles can execute slash commands
* Use the manifest copy-paste flow to minimize YAML/JSON formatting errors

If you have any further questions, contact your Dropzone AI support representative