Overview

Integrate Datadog with Slack to:

• Receive notifications from Datadog to never miss an important event.
• Declare, collaborate on, and resolve Datadog incidents without leaving Slack.
• Share graph snapshots and preview pasted Datadog links.
• Use Datadog Workflow Automation to send messages, decision prompts, and more.
• Monitor Slack Enterprise Grid audit logs with Datadog Cloud SIEM.

Setup

Monitors

With the integration, you can receive monitor alerts and mute monitors directly from Slack. For detailed instructions on how to create monitors, see Configuring Monitors. To send monitor alerts to a Slack channel, invite Datadog to the channel first using the /invite @Datadog command.

Notification messages

You can use the same rules, variables, and tags as standard Datadog Notifications. For example, this notification pings a team in a Slack channel called infrastructure when a monitor is renotifying:

CPU usage has exceeded {{warn_threshold}} on {{ @machine_id.name }}.
{{#is_renotify}}
Notifying @slack-infrastructure <!subteam^12345>
{{/is_renotify}}

Channels

To specify a Slack channel when configuring a notification message, type @slack in the monitor message box to see the available list of channels you can send the notification to.

Note: Trailing special characters in a channel name are not supported for Slack @-notifications. For example, @----critical_alerts works, but @--critical_alerts-- does not.

@-mentions

Use the following commands to create @-mentions in notification messages:

@users

command: <@username>

Notify a Slack user using their Slack username. Their username can be found in their Slack account settings under Username. For example: @slack-SLACK_CHANNEL <@USERNAME>, or @slack-SLACK_ACCOUNT-SLACK_CHANNEL <@USERNAME>.

@here

command: <!here>

Notify every online member that is a part of the channel the alert is being sent to.

@channel

command: <!channel>

Notify every member that is a part of the channel the alert is being sent to.

@usergroups

command: <!subteam^GROUP_ID>

Notify every member belonging to a user group in Slack. For example, you would use <!subteam^12345> for a user group with an ID of 12345. To find the GROUP_ID, navigate to More > Your organization > People > User groups. Select a user group, click the ellipsis, and select Copy group ID. You can also query the usergroups.list API endpoint.

You can also use message template variables to dynamically build @-mentions. For example, if the rendered variable corresponds to a specific channel in Slack:

• @slack-{{owner.name}} sends notifications to the #owner.name’s channel.
• @slack-{{host.name}} sends notifications to the #host.name channel.

To create @-mentions that go to specific email addresses:

• @team-{{team.name}}@company.com sends an email to the team’s mailing list.

Monitor alerts in Slack

When a monitor alert is sent a Slack channel, it contains several fields:

• The notification message
• A snapshot (graph) of the query that triggered your monitor
• Related tags
• The names of the users or groups that were notified

To customize the content included in monitor alert messages in Slack, navigate to the integration tile. For each channel, select or clear the checkbox for each monitor alert option.

Migrate monitors from Slack Webhook (Legacy) to the Datadog app for Slack

If your monitors are using legacy Slack Webhooks, there are two ways you can update your monitors to be sent from the Datadog app:

• Bulk upgrade: Bulk upgrade all of your monitors by clicking the Install button at the top of the configuration for each of your Slack accounts in the integration tile. After redirecting to Slack, select the same Slack workspace that is connected to your legacy webhook.
• Individual upgrades: Manually add channels to the new configuration in the integration tile. You may need to remove duplicate references to the same channels.

Dashboards

You can post dashboard widget snapshots to any Slack channel.

To share a dashboard widget in Slack:

• In Datadog, hover over a dashboard widget and press CMD + C or CTRL + C, or click the Copy button from the share menu, and then paste the link into Slack.

Home Tab

Use the Home tab on the Datadog App in Slack to view your starred dashboards, notebooks, and services. You can also view a list of monitors that were triggered in the past 24 hours and their associated Slack channels. If you’re a member of more than one Datadog account, filter the tab by switching between accounts.

Incidents

Anyone in your Slack organization can declare an incident, even if they don’t have access to Datadog. When an incident is declared, Datadog automatically creates a dedicated Slack channel named #incident-(unique number ID). A message is posted to announce the new channel, and the channel topic updates as the incident progresses.

For more information on how to use Slack with Incident Management—including incident declaration, channel automation, message syncing, responder management, and notification settings—see the Slack integration documentation.

/datadog workflow

Limit edit access

By default, all users have full access to connected Slack workspaces.

Use Granular Access Control to limit which roles can edit a specific workspace:

1. Navigate to the integration tile.
2. Click the Channels tab.
3. Select the Slack workspace you want to restrict edit access to.
4. Click the gear icon in the upper-right corner to open the settings menu.
5. Select Permissions.
6. Click Restrict Access. The dialog box updates to show that members of your organization have Viewer access by default.
7. Use the dropdown to select one or more roles, teams, or users that can edit the Slack workspace.
8. Click Add. The dialog box updates to show that the role you selected has the Editor permission.
9. Click Save.

Note: To maintain your edit access to the workspace, you must include at least one role you belong to before saving.

If you have edit access, you can restore general access to a restricted workspace by completing the following steps:

1. Navigate to the integration tile.
2. Click the Channels tab.
3. Select the Slack workspace you want to restore general access to.
4. Click the gear icon in the upper-right corner to open the settings menu.
5. Select Permissions.
6. Click Restore Full Access.
7. Click Save.

Permissions

Datadog for Slack requires the following OAuth Scopes. See the Slack permission scopes documentation for more information.

Bot Token Scopes

Optional Bot Token Scopes

Datadog for Slack offers features that require enabling additional optional Bot Token Scopes. These scopes are added dynamically based on feature enablement and are not added during the initial installation.

User Token Scopes

Optional User Token Scopes

Datadog for Slack offers features that require enabling additional optional User Token Scopes. These scopes are added dynamically based on feature enablement and are not added during the initial installation.

Enterprise Grid audit logs

Ingest events and actions that occur within your Slack Enterprise Grid.

Start collecting Slack audit logs

Only owners of an Enterprise Grid organization may authorize Datadog to collect Slack audit logs.

1. On the integration tile, click the Audit Logs tab.
2. Click Connect Enterprise Grid to be redirected to Slack for authorization.

Collected events and actions

• User management events, such as user creation, deletion, and updates. This includes changes to user roles, permissions, and profiles.
• Workspace and channel management events, including actions related to the creation, modification, and deletion of channels and workspaces. It also tracks changes in workspace settings and permissions.
• File and app management events, including tracking the upload, download, and deletion of files, as well as monitoring the installation, update, and removal of Slack apps and integrations.
• Security and compliance events, including login attempts, password changes, and two-factor authentication events, as well as compliance-related actions like data exports and access to sensitive information.
• Audit trail of administrative actions, including changes made by Slack admins and workspace owners, such as policy updates, security settings changes, and other administrative modifications.
• External sharing and collaboration events, including the creation of shared channels, external invitations, and guest account activities.

Each event captured provides detailed insights, including:

• Action: What activity was performed.
• Actor: The user in the workspace who generated the event.
• Entity: The thing the actor has taken action upon.
• Context: The location (workspace or enterprise) where the actor took action on the entity.

For more information, see the official Slack documentation.

Data Collected

Metrics

The integration for Slack does not provide any metrics.

Events

The integration for Slack does not include any events.

Service Checks

The integration for Slack does not include any service checks.

Troubleshooting

Need help? Contact Datadog support.

Further Reading

추가 유용한 문서, 링크 및 기사:

Monitor Slack audit logs with Datadog Cloud SIEMBLOG