Slack Alarm Integration

Overview

Cremit's Slack integration enables real-time security alerts directly in your Slack workspace. Receive instant notifications when active secrets are detected, scan sources fail verification, or security incidents are created.

---

Step-by-Step Setup

Step 1: Add Slack Channel

1. Navigate to Configuration > Alarms in your Cremit dashboard
2. Click on the Channel tab
3. Click Add Channel button
4. Select Slack from the available options (Slack, Webhook, Telegram)

Step 2: Configure Slack Channel

1. Name: Enter a channel identifier (e.g., #security-alerts)

   • This is for your reference in Cremit

2. Description: (Optional) Add a description (e.g., "Security team alerts channel")

3. Click Create Channel

Step 3: Authorize Slack Integration

After clicking "Create Channel", you will be automatically redirected to Slack to complete the OAuth authorization:

1. Authorize Argus (Cremit) to access your Slack workspace
2. Select the Slack channel where you want to receive notifications
3. Confirm the authorization

Once authorized, you'll be redirected back to Cremit and the channel will be ready to use.

Note: If you prefer to use Slack Incoming Webhooks instead of the OAuth app, select the Webhook tab and enter your webhook URL directly.

---

Step 4: Create Alarm Rules

Now that your Slack channel is connected, configure when you want to receive notifications:

1. Navigate to Configuration > Alarms > Alarms tab
2. Click Create Alarm or New button
3. Configure the alarm settings:

Alarm Channels:

• Select your previously created Slack channel from the dropdown
• Multiple channels can be selected

Alarm Name:

• Enter a descriptive name (e.g., "Active Secret Alert")

Description:

• (Optional) Describe what this alarm monitors

Trigger Type: Select when this alarm should trigger:

• Active Secret Detected - When a new active credential is found
• Active Public Secret Detected - When an active credential is exposed in public repositories
• Inactive Secret Reactivated - When a previously inactive secret becomes active again
• Scan Source Verification Failed - When connection to a scan source fails
• Incident Created - When a new security incident is created

4. Click Create Alarm to save

---

Verification

To verify the integration is working:

1. Check that your Slack channel appears in the Channel tab with "Enabled" status
2. Verify your alarm rules are listed in the Alarms tab
3. You can use the Preview tab when creating an alarm to see what the notification will look like
4. Test the integration by triggering a test alert (if available) or wait for a real event

---

Managing Alarms

View Alarm History:

• Navigate to the Alarm Log tab to see all triggered alarms
• Filter by type, status, or time range

Edit Alarms:

• Click on any alarm in the Alarms tab to modify its settings
• You can change channels, trigger types, or other configurations

Disable/Enable Alarms:

• Toggle alarms on or off without deleting them
• Useful for maintenance periods or testing

---

Troubleshooting

No channels available when creating alarm

• Issue: "No enabled channels available" message appears
• Solution: First create and authorize at least one Slack channel in the Channel tab

Not receiving notifications

• Issue: Alarm is created but no Slack messages are sent
• Solution:
  • Verify the Slack channel is "Enabled" in the Channel tab
  • Check that the alarm rule is enabled
  • Ensure Argus app has permission to post in the selected Slack channel

Authorization failed

• Issue: Slack authorization doesn't complete
• Solution:
  • Make sure you have admin permissions in your Slack workspace
  • Try using the Webhook option instead of OAuth
  • Check if your organization has restrictions on Slack app installations

Using Slack Webhooks instead of OAuth

• If you prefer or need to use Incoming Webhooks:
  1. Create an Incoming Webhook in your Slack workspace
  2. Select the Webhook tab instead of Slack when adding a channel
  3. Paste your webhook URL
  4. Complete the channel setup

---

Notification Types

Cremit sends different types of notifications based on trigger types:

Active Secret Detected:

• Severity level (Critical, High, Medium, Low)
• Secret type (API key, token, password, etc.)
• Location (repository, file path)
• Detection timestamp
• Quick action buttons

Scan Source Verification Failed:

• Scan source name
• Failure reason
• Timestamp
• Troubleshooting suggestions

Incident Created:

• Incident ID and title
• Severity level
• Affected resources
• Link to view details in Cremit

---

Best Practices

✅ Create separate channels for different severity levels (e.g., #security-critical, #security-info)
✅ Use descriptive alarm names to quickly identify the purpose
✅ Set up multiple alarms with different trigger types for comprehensive coverage
✅ Test notifications before relying on them in production
✅ Review alarm logs regularly to tune your alerting rules
✅ Document your notification channels so team members know where to look for alerts

---

Key Benefits

✅ Instant Alerts: Real-time notifications when security events occur
✅ Team Collaboration: Alerts go directly to your team's communication hub
✅ Flexible Setup: Choose between OAuth app or webhooks
✅ Multiple Trigger Types: Configure alerts for different security events
✅ Easy Management: Enable, disable, or modify alarms anytime
✅ Rich Notifications: Detailed information with quick action buttons