Slack
PhishNet can post real-time threat alerts to your Slack workspace. When an email is flagged or quarantined, PhishNet sends a formatted alert to the channels you choose — each with its own severity threshold — so your security team sees threats the moment they land.
This is an org-wide integration: an owner or admin connects the workspace once, and alerts cover every mailbox in the organisation. It is available on Team and Enterprise plans.
Connecting your workspace
- In the PhishNet admin dashboard, open Integrations → Slack.
- Click Add to Slack. You'll be taken to Slack to authorise PhishNet.
- Approve the requested permissions (PhishNet asks only for what it needs — see Permissions).
- You'll be returned to the dashboard with the workspace connected.
Each PhishNet organisation connects to one Slack workspace. Re-running the install for the same org refreshes the connection (rotating the bot token).
Routing alerts to channels
Once connected, add one or more channels. Each channel is an independent route with its own filters:
- Click Add channel and pick a channel from the list.
- Set the minimum severity for that channel.
- Choose which events the channel subscribes to.
- Toggle the channel on or off at any time without removing it.
PhishNet posts to a channel only when an alert matches both the channel's event subscription and its severity threshold.
PhishNet can only post to channels the bot has joined — this applies to both public and private channels. Before (or after) adding a channel here, invite the bot in Slack:
/invite @PhishNet
If the bot isn't in a channel, deliveries to it fail with not_in_channel (visible in the delivery log below). Inviting the bot and re-sending fixes it.
Severity threshold
| Threshold | Alerts delivered |
|---|---|
| Suspicious & above | Suspicious and phishing emails |
| Phishing only | Phishing emails only (lowest noise) |
Events
| Event | When it fires | Severity |
|---|---|---|
Flagged (email.flagged) | A suspicious or phishing email that was not quarantined | Severity of the scan (suspicious or phishing) |
Quarantined (email.quarantined) | An email was quarantined — by policy or by a user | Phishing |
Restored (email.restored) | A quarantined email was marked safe | Informational (always delivered when subscribed) |
By default a new channel subscribes to Flagged and Quarantined with the Phishing only threshold — so out of the box you receive phishing quarantines, and lowering the threshold to Suspicious & above starts including suspicious mail too.
What an alert looks like
Each alert is a Slack message with a severity header (🔴 phishing, 🟠 suspicious, 🟢 restored), the sender, subject, recipient, and phish score, plus a button that links straight to the scan in the PhishNet dashboard. Email contents are PII-redacted before they leave PhishNet.
Testing a channel
Use Send test next to any channel to post a sample alert to it. This confirms the bot is in the channel and the route is wired correctly before you rely on it.
Delivery log
The dashboard lists your most recent Slack deliveries under Integrations → Slack, with the event type, status, and any error returned by Slack. PhishNet retries transient failures (rate limits, Slack 5xx) automatically; permanent errors are marked failed so you can fix the cause and re-send. Common errors:
| Slack error | Meaning | Fix |
|---|---|---|
not_in_channel | The bot hasn't joined the target channel | Run /invite @PhishNet in that channel, then Send test again |
channel_not_found | The channel was deleted or the bot can't see it | Pick a different channel, or re-invite the bot |
invalid_auth / token_revoked | The bot token is no longer valid | Disconnect and reconnect Slack |
Permissions
PhishNet requests these Slack bot scopes:
| Scope | Why |
|---|---|
chat:write | Post alert messages to your channels |
channels:read | List public channels in the route picker |
groups:read | List private channels the bot has been invited to |
PhishNet never reads your messages and never posts anywhere except the channels you configure.
Disconnecting
Click Disconnect in Integrations → Slack to revoke PhishNet's access and remove all channel routes. You can reconnect at any time.
Prefer a raw event stream?
If you want Slack alerts wired through your own tooling, or need to reach a system PhishNet doesn't integrate with directly, the SOC Webhook delivers the same events as signed HTTP POSTs.