Slack enterprise workspace created or deleted

slack

Classification:

attack

Tactic:

TA0040-impact

Technique:

T1531-account-access-removal

Set up the slack integration.

이 페이지는 아직 영어로 제공되지 않습니다. 번역 작업 중입니다.
현재 번역 프로젝트에 대한 질문이나 피드백이 있으신 경우 언제든지 연락주시기 바랍니다.

Goal

Detects Slack workspace creation or deletion events.

Strategy

This rule monitors Slack audit logs for @evt.name:workspace_created and @evt.name:workspace_deleted events from the audit-logs-service.

Triage & Response

  • Verify if {{@usr.email}} has authorization to create or delete workspaces.
  • Check if the workspace action aligns with business requirements.
  • Review the user’s permissions and role assignments.
  • Assess the impact on data access and organizational structure.