Get server security alerts in Slack: the guide
Security alerts have one problem: they arrive where nobody looks. An automated email buried in the inbox, a console only opened during outages, a log file on the server.
Slack is where your team spends its day. Sending security information there makes sure it gets seen.
Instant alert or daily report?
Sending everything to Slack in real time is the best way to make the channel useless: after a week, nobody reads the messages anymore. Distinguish two kinds of information:
| Type | Examples | Channel |
|---|---|---|
| Instant alert | Infected file detected, critical service down, unusual root login | Instant message |
| Daily summary | Blocked attempts, versions to update, performance trends | One report a day |
A good rule: an instant alert must require action within the hour. Everything else goes in the daily report.
Create a Slack incoming webhook
An incoming webhook is the simplest way to post to a channel from a server:
- Create a dedicated channel, for example #server-security.
- Open api.slack.com/apps and create an app From scratch.
- Under Incoming Webhooks, enable the feature.
- Click Add New Webhook, pick the channel and allow.
- Copy the generated URL.
To test from a server:
curl -X POST -H 'Content-Type: application/json' \
--data '{"text":"Test: Slack connection OK"}' \
https://hooks.slack.com/services/XXX/YYY/ZZZProtect the webhook URL
A webhook URL lets anyone post to your channel. Treat it like a password:
- never commit it to a code repository;
- do not store it in plain text in a world-readable script;
- regenerate it if it leaked, by deleting the old webhook in the app settings.
Make the report readable
A good security report in Slack fits on one screen:
- a header line with the key indicators (threat level, CPU, disk, number of vulnerabilities);
- critical alerts first, or "nothing to report";
- recommended actions, two or three at most;
- technical details below, for those who want to dig in.
This is where AI helps: turning thousands of log lines into a short message that says what to do.
Frequently asked questions
Should I use one channel per server?
Not at first. A single channel with one report per server stays readable up to about ten servers. Beyond that, group by environment (production, staging).
Does my Slack admin need to approve the app?
Depending on your workspace settings, installing an app may require approval. The webhook only grants permission to post in one specific channel.
With FondateurMode, one command is enough: fondateurmode slack set-webhook URL. The URL is stored encrypted off your server, and you get a clear daily report plus an instant alert if an infected file is found. Read the Slack guide.