← Integrations
Webhooks
Slack
Post threat.detected and list.updated to a channel with the policy and hostname, with an approve action that calls the list entry endpoint.
Integration steps for Slack
Receiver that posts to Slack
Verify the Securd signature, then post the policy, hostname and categories.
bridge.py
import hmac, hashlib, os, httpx
from fastapi import FastAPI, Request, HTTPException
app = FastAPI()
SECRET = os.environ["SECURD_WEBHOOK_SECRET"]
SLACK = os.environ["SLACK_WEBHOOK_URL"]
@app.post("/securd/events")
async def events(request: Request):
raw = await request.body()
sig = "sha256=" + hmac.new(SECRET.encode(), raw, hashlib.sha256).hexdigest()
if not hmac.compare_digest(sig, request.headers.get("X-Securd-Signature", "")):
raise HTTPException(401)
ev = await request.json()
d = ev.get("data", {})
text = f":warning: {ev.get('event')} in {d.get('site_name') or 'unknown site'}: {d.get('domain', '')}"
httpx.post(SLACK, json={"text": text}, timeout=10)
return {"ok": True}
Approve from the thread
A slash command or interactive button calls the list entry endpoint with the hostname and a source_ref containing the Slack permalink. The change log records the approving user.
Verification
Two queries: one confirms ingestion, one lists first-seen destinations by policy.
Verification
text
A threat.detected event from a policy appears in the channel within seconds of the resolution.Approval shows up in the change log
bash
curl -s "https://control.securd.com/api/v1/gateway/audit/changelog" -H "Authorization: Bearer $TOKEN" -H "X-Tenant-UUID: $TENANT" | jq '.data[] | select(.source_ref | test("slack"))'Evaluate Agent DNS with your own agent traffic
Forward events from a single policy and review them with your security team.