Scan Slack for secrets

Connect Slack as a data source to HCP Vault Radar to scan your Slack channels for sensitive data and secrets.

If you are new to HCP Vault Radar, checkout the HCP Vault Radar quickstart series.

Prerequisites

Permission in Slack to install third-party apps from the marketplace.
HCP IAM user with the HCP owner, or admin role.
Vault Radar agent deployed and running (agent scan only).

Scan up to 5000 channels

HCP Vault Radar allows you to scan up to 5000 channels per workspace. If you have more than 5000 channels, Vault Radar selects the 5000 channels with the most recent activity.

Add a Slack data source

Click Settings/Data Sources.
Select HCP Vault Radar Scan.
Under Team Collaboration, click Slack.
Click Connect to Slack to install the Slack app. This initiates the OAuth flow with Slack.
Select the Slack workspace from the dropdown list and click Allow
Permission required to install Slack app
If you do not have permission to install apps into the selected workspace, you will see a Submit Request button instead of the Allow button.
Coordinate with your Slack workspace administrator to approve the app installation.
HCP Vault Radar displays the message Authenticated to Slack.
Click Next.
Select either All active channels or Select channels to monitor.
The onboarding workflow joins the Slack app to the selected channels. If you have a large number of channels, this process will take several minutes to complete.
Click Finish to start onboarding and scanning the selected channels.

The Vault Radar agent scan integrates with Slack using a self-created Slack app. You create the Slack app before adding Slack as a data source in Vault Radar.

Learn more about the HCP Vault Radar agent in the HCP Vault Radar operations tutorials.

Create a Slack app

Log into Slack with an account that has permission to create apps in your workspace.
Navigate to api.slack.com/apps.
Click Create New App.
Click From a manifest.
Select the workspace where you want to install the app and click Next.
Click the YAML tab.

Enter the following manifest, replacing YOUR_PROJECT_ID with your HCP project ID and YOUR_WORKSPACE_NAMEwith your Slack workspace ID on line 26.

display_information:
  name: Vault Radar Integration
  description: Slack integration for HashiCorp Vault Radar
  background_color: "#FFFFFF"

features:
  bot_user:
    display_name: Vault Radar Bot
    always_online: true

oauth_config:
  scopes:
    bot:
      - channels:history
      - channels:join
      - channels:read
      - users:read
      - users:read.email

settings:
  event_subscriptions:
    request_url: https://api.cloud.hashicorp.com/2023-05-01/vault-radar/projects/YOUR_PROJECT_ID/api/webhook-events/code-servers/slack-cloud?org=YOUR_WORKSPACE_NAME
    bot_events:
      - app_uninstalled
      - channel_archive
      - channel_created
      - channel_deleted
      - channel_left
      - channel_rename
      - channel_unarchive
      - message.channels
  org_deploy_enabled: false
  socket_mode_enabled: false
  token_rotation_enabled: false

Click Next.
Review the app configuration and click Create.

Enable OAuth and gather tokens

Log into the HCP Portal with a user that has permission to configure Vault Radar data sources.
Navigate to OAuth & Permissions.
Click Install to Your Workspace, a new page opens.
Click Allow.
Copy the Bot User OAuth Token.
Set an environment variable on the agent host to store the OAuth token.
Example shell command:
```
export SLACK_OAUTH="xoxb-xxxxxxxxxx-xxxxxxxxxxxx-xxxxxxxxxxxxxxxxxxxxxxxx"
```
Navigate back to Basic Information
Copy the Signing Secret and store it securely. You will use this secret to configure Vault Radar.
The Slack app is ready to connect to Vault Radar.

Add Slack data source

Click Settings and select Data Sources.
Select HCP Vault Radar Agent Scan.
Under Team Collaboration, click Slack.
Enter the following information:
- Enter your Slack workspace name: The name of the Slack workspace where you created the Slack app in the previous section.
- Enter environment path to your Slack user OAuth token: The environment variable name where stored the Slack OAuth token on the agent host.
Example:
```
env://SLACK_OAUTH
```
- Enter your Slack signing secret: The signing secret copied from the Slack app configuration page.
Click Next.
Select either All active channels or Select channels to monitor.
Click Finish to start onboarding and scanning the selected channels.

Verify the app for event listening

Return to the Slack app configuration page to verify that the app is properly configured to listen for events.

Select Event Subscriptions from the app management page
Verify the Request URL displays Verified
Note
If you see the message Your URL didn't respond, next to the Request URL, click Retry.

Assign a group to a resource

Once you add a data source, an HCP user with the admin role must assign a group to each of the monitored resources within each data source. You can assign each resource to only one group.

Note

Users with the HCP IAM admin role do not need to be a member of other groups. Accounts with the admin role have full access to Vault Radar.

If you do not already have a group, refer to the Identity and Access Management groups documentation to create a group.

Navigate to the Project dashboard.
Click Access control (IAM).
Click Add new assignment.
Search the name of the group in the Search for an assignee search field.
Click the group name in the search results.
Click the Select service pulldown menu and select Vault Radar.
Click the Select role pulldown menu and select the Vault Radar Developer role.
Click Save.
Click Back to Dashboard.
Click Vault Radar.
Click Resources.
Select the resource you want to assign to a group and click Assign groups.
Click the Assign resoruce to group pulldown menu.
Select the group that requires access to the resource.
Select either the Viewer or Contributor role.
Click OK.

Update data source

Navigate to Settings.
Click Data Sources
Click the vertical ellipsis to the right of the data source..
To update the monitored data sources, click Edit data sources.
To update the token, click Edit data source host details.
To delete the data source host, click Delete data source host.

Tutorials

Learn how to evaluate and implement HCP Vault Radar in your environment with our tutorials.

HCP Vault Radar quickstart - Follow HashiCups, a fictitious coffee company, as they onboard HCP Vault Radar and scan their data sources for secrets.
HCP Vault Radar operation - Learn how HashiCups uses HCP Vault Radar advanced features to scan data sources with the Vault Radar agent, and correlates findings with HCP Vault to manage secrets.