Skip to main content
Flarehawk posts structured alert messages to a Slack channel of your choice when detection rules fire. The integration uses a standard Slack OAuth flow to authorize the Flarehawk app in your workspace, so no manual token management is required. This page walks through connecting Slack, choosing a channel, configuring severity filters, and resolving common issues.
Alert Slack vs. support Slack Connect: This page covers alert notifications — Flarehawk posting incidents into a channel in your Slack workspace. Paid plans also include an optional dedicated support channel via Slack Connect: Flarehawk creates a private shared channel in the Vigilbase workspace and invites you by email. Set that up during onboarding or from Organization → Overview in the dashboard. It does not replace or reuse your alert notification connection.

​
Connecting your Slack workspace

1

Open integrations settings

In the Flarehawk dashboard, navigate to Settings and click the Integrations tab.
2

Start the Slack OAuth flow

Click Connect Slack. You are redirected to Slack’s authorization page.
3

Authorize the Flarehawk app

Select the Slack workspace you want to connect and click Allow. Flarehawk requests the permissions it needs to post messages on your behalf.
4

Return to Flarehawk

After authorization, you are redirected back to the dashboard. The Integrations tab shows your workspace as connected.
5

Choose a Slack channel

Go to Settings → Notifications and enable the Slack channel. Select the Slack channel where alerts should be posted. Public channels are available immediately. For private channels, you must first invite the Flarehawk app to that channel in Slack before it appears as an option.
6

Save your settings

Click Save. New alerts that meet your severity threshold will be posted to the selected channel.
Only organization admins can connect and configure the Slack integration.

​
What a Slack alert message looks like

Each Slack alert is a rich structured message containing:
  • Header — severity emoji and event title (for example, 🔴 New critical Incident on api.example.com)
  • Incident review — plain-language narrative describing what was observed
  • Key fields — severity, attack type, alert count, domain, organization, and timestamp
  • Highlights — up to four key metrics from the detection, such as request counts or baseline comparisons
  • AI analysis — root cause, mitigation plan, and action items where available
  • Action buttons — inline buttons to Investigate, Acknowledge, or Mitigate, each linking directly to the incident in the dashboard

​
Configuring severity filters for Slack

You can set a minimum severity level so that only alerts at or above the threshold are posted to Slack. This is useful for keeping a high-signal channel rather than receiving every low-severity alert.
  1. Go to Settings → Notifications.
  2. Under the Slack channel, select a Minimum severity level.
  3. Save your settings.
Alerts below the threshold are not posted to Slack, even if other channels (such as email) are configured to receive them.

​
Disconnecting Slack

To remove the Slack integration:
  1. Go to Settings → Integrations.
  2. Click Disconnect next to your connected workspace.
  3. Confirm the action.
Disconnecting removes the Flarehawk app’s access to your Slack workspace. The Slack channel and severity configuration in Settings → Notifications are cleared. You can reconnect at any time by following the setup steps above.
Disconnecting Slack disables Slack notifications immediately. Reconnecting requires completing the OAuth flow again and reconfiguring your channel preference.

​
Troubleshooting

Check the following in order:
  • The Slack channel is enabled in Settings → Notifications (the toggle is on).
  • A channel is selected. If no channel is configured, Flarehawk cannot post messages even when the channel is enabled.
  • Your minimum severity setting is not filtering out the alerts you expect. Temporarily lower the threshold to low and send a test notification.
  • The alert severity meets the threshold you’ve configured.
The Flarehawk Slack app must be a member of the private channel before it can post to it. In Slack, open the private channel, click the channel name, go to Integrations, and add the Flarehawk app. Then return to Flarehawk and select the channel from the dropdown.
This means the Slack app was not authorized with the permissions it needs to post messages. Disconnect and reconnect your Slack workspace to complete a fresh OAuth authorization with the correct scopes.
The channel list is populated from your Slack workspace after authorization. If the list is empty, check that your Slack workspace has at least one public channel, or that you’ve invited the Flarehawk app to a private channel first. Try disconnecting and reconnecting Slack.
If you rename or archive the channel Flarehawk was posting to, deliveries fail silently. Go to Settings → Notifications, select a new active channel, and save.