Slack Integration

Overview

The Slack integration connects your Slack workspace to Fencer so you can receive real-time security notifications directly in your channels and direct messages. Notification rules decide which events go to which channels and people, and you can act on vulnerabilities and detections without leaving Slack.

Prerequisites

An active Fencer organization with a valid subscription.
The Administrator role in the Fencer organization.
The Workspace Admin or Workspace Owner role in Slack, or another role that can add apps to your workspace.

How it works

Fencer uses a Slack OAuth app to connect to your workspace. During setup, you authorize the app with scopes that allow it to list channels, join public channels, send messages, read the threads it takes part in, and read your workspace’s users and user groups. Once connected, Fencer stores an encrypted OAuth token that it refreshes automatically.

When an event matches a notification rule (for example, a new vulnerability is detected or a SIEM rule fires), Fencer sends a formatted Slack message to the channel the rule names, or as a direct message to the people it names. Interactive messages let your team assign, ignore, or investigate items directly from the notification.

Usage / Configuration

Connecting Slack

Go to Admin > Integrations.
Click the Slack card under Available Integrations.
Read the summary, click Continue, then click Connect Slack.
You are redirected to Slack’s app installation page. Review the requested permissions and click Allow.
After authorization, Fencer opens Settings > Notifications so you can route rules to Slack. In Admin > Integrations, the connection shows your Slack workspace name.

Sending notifications to a channel

Go to Settings > Notifications and create or edit a rule.
Under Send it to, turn on Send Slack channel message and select a channel. If a new channel is missing, click Re-sync channels under Can’t find your channel?.
Click Save rule. One rule can send to Slack and to other destinations at once.

Fencer can post to public channels and to private channels the Fencer app has been added to.

Sending direct messages

To yourself: open User settings > Notifications and turn on Send me a DM on Slack on any of your personal rules. The Task Assigned rule does this by default.
To others: on an organization rule, turn on Send Slack direct message and pick The assignee (on triggers that have one, such as vulnerabilities and tasks), Organization admins, or A specific member.

Fencer finds each person’s Slack account by matching their Fencer email address to their Slack profile. If there is no match, that person does not receive the DM.

Testing notifications

In the rule editor, click Test send, choose the Slack destination (or Send to all actions), and confirm with Send test. Fencer sends one real message to the destination.

See Notifications and Alerts for triggers, conditions, and delivery timing.

Disconnecting Slack

Go to Admin > Integrations.
Click Remove (the trash icon) on the Slack connection’s card, then confirm with Remove.
Fencer uninstalls the app from your workspace, clears the stored tokens and removes the Slack identities it synced.

Identity sync

Fencer also syncs your workspace’s members and bots into Posture > Identities, with each person’s email address, role, account status and two-factor authentication status. The sync runs when you connect the workspace and again every night, on plans that include Identities.

Asking Fencer in Slack

Anyone in your workspace whose Slack email address matches a member of your Fencer organization can ask Fencer a question: mention the Fencer app in a channel it can read, or send it a direct message. Fencer replies in the thread, working with that person’s Fencer access. People without a matching Fencer account get a reply asking them to have an admin invite them. Questions count toward your organization’s daily AI request limit; once it is reached, Fencer replies “Your organization has reached the daily AI request limit. Please try again tomorrow.”

Replying to detection notifications

When someone replies in the Slack thread of a detection notification, Fencer adds the reply as a comment on the detection. It does this only for people whose Slack account matches a Fencer member who can edit detections.

Slack shares a channel’s messages only with apps that are in the channel, so when Fencer posts a detection notification to a public channel it is not in, it joins the channel, and Slack shows that Fencer joined. In a private channel the Fencer app is already a member, because it can only post where it was added.

Examples

Responding to a security detection in Slack

When a SIEM rule fires, Fencer posts a notification to the rule’s channel with the detection title (linked to the detection in Fencer), severity, status, and recommendations. The message includes interactive controls:

Investigate — transitions the detection to “Under Investigation” status and posts a thread reply noting who took the action.
Mark as False Positive — resolves the detection as a false positive and updates the Slack message status.
Assign to… — a dropdown to assign the detection to a team member.

Triaging a vulnerability from Slack

When a New vulnerability detected message lists a single vulnerability, it has:

Assign to… — select a team member to assign the vulnerability.
Ignore reason… — select a reason to mark the vulnerability as ignored.
Fix — shown when Fencer can fix the vulnerability.

When it lists 2 to 10 vulnerabilities, Assign all to… and Ignore all with reason… act on all of them. View in Fencer opens the matching vulnerabilities.

Troubleshooting

“New Slack permissions required. Please remove and re-connect the Slack integration through Fencer.” in the channel picker — Fencer needs permissions the app did not have when it was connected. Remove and re-connect the Slack integration to grant them.
“The Slack connection is no longer valid.” in the channel picker — The token was revoked or the app was removed in Slack. Re-connect the Slack integration.
Notifications not arriving — Verify the Slack connection is healthy in Admin > Integrations, check that the rule is active, and use Test send to confirm delivery. For a private channel, add the Fencer app to the channel.
User DMs not delivered — Fencer looks up Slack users by email address. Ensure the user’s Fencer email matches their Slack workspace email.
Slack replies not showing as detection comments — Fencer only adds replies from people whose Slack email matches a Fencer member who can edit detections. Replies are synced only in a detection notification’s own thread. If Slack was connected before mid-April 2026, remove and re-connect the Slack integration to grant Fencer permission to read replies.
Channel not appearing in the list — Click Re-sync channels to reload channels from Slack. The channel list is cached and refreshed every night, so it may not show recently created channels.