Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[Slack] Parse Slack File URL #10725

Open
christophercutajar opened this issue Aug 7, 2024 · 1 comment · May be fixed by #11445
Open

[Slack] Parse Slack File URL #10725

christophercutajar opened this issue Aug 7, 2024 · 1 comment · May be fixed by #11445
Assignees
Labels
bug Something isn't working, use only for issues Integration:slack Slack Logs Team:Security-Service Integrations Security Service Integrations Team [elastic/security-service-integrations]

Comments

@christophercutajar
Copy link

Currently, details.url_private is not being parsed. This field is available when event.action: file_downloaded

Sample document:

{
    "action": "file_downloaded",
    "actor": {
        "type": "user",
        "user": {
            "email": "[email protected]",
            "id": "2f52269c-4f38-4f08-b56d-c2b968681dbd",
            "name": "User McUser",
            "team": "user-team"
        }
    },
    "context": {
        "ip_address": "81.2.69.144",
        "location": {
            "domain": "domain.tld",
            "id": "eedd1a7d-1a92-418d-8b01-51a4c809d0fb",
            "name": "The Place",
            "type": "workspace"
        },
        "session_id": 913888259765,
        "ua": "com.tinyspeck.chatlyio/23.04.40 (iPhone; iOS 1.4.1; Scale/3.00)"
    },
    "date_create": 1683836275,
    "details": {
        "url_private": "https://example.com/"
    },
    "entity": {
        "file": {
            "filetype": "image/png",
            "id": "7edc4c42-f925-47af-979a-22c10e1fefed",
            "name": "image.png",
            "title": "image.png"
        },
        "type": "file"
    },
    "id": "2db28060-1659-4b27-ad55-fdba12e3a7b1"
}
@christophercutajar christophercutajar added Integration:slack Slack Logs bug Something isn't working, use only for issues Team:Service-Integrations Label for the Service Integrations team labels Aug 8, 2024
@jamiehynds jamiehynds added Team:Security-Service Integrations Security Service Integrations Team [elastic/security-service-integrations] and removed Team:Service-Integrations Label for the Service Integrations team labels Oct 8, 2024
@elasticmachine
Copy link

Pinging @elastic/security-service-integrations (Team:Security-Service Integrations)

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
bug Something isn't working, use only for issues Integration:slack Slack Logs Team:Security-Service Integrations Security Service Integrations Team [elastic/security-service-integrations]
Projects
None yet
Development

Successfully merging a pull request may close this issue.

4 participants