Slack
Slack
Connect to Slack to scan channel messages.
- Category
- Collaboration
- Source type
- SLACK
- Produces
- messageattachment
Slack is where the data that shouldn’t be in Slack ends up: a password pasted into a channel, a customer list dropped as a CSV, a screenshot of a dashboard full of account numbers. Every one of those is scannable.
What you need to connect
Your workspace name and a bot token (xoxb-…). Create a Slack app,
install it into the workspace, and copy the bot token.
The token needs read scopes for the conversations you want:
channels:read, channels:history for public channels; groups:read,
groups:history for private ones; mpim:* and im:* for group and direct
messages; and files:read if you want shared files scanned.
Bot tokens only, on purpose. A bot token is the credential a workspace admin can scope, audit and revoke. The bot sees only conversations it has been invited to — that boundary is the point, not a limitation.
What Classifyre reads
Each message becomes an asset, and each file shared in a message becomes an asset of its own linked back to the message.
You control:
- Which conversations — by type (public, private, group DM, DM), by explicit channel IDs, and whether archived channels are included.
- Thread replies — fetched alongside their parent message when enabled.
- A time window — scan only messages between two timestamps.
- Which files — extension allow/denylists and a size cap.
Public channels the bot isn’t in can be joined automatically before reading; without that, Slack simply reports no access.
Files shared in Slack are read with the shared file pipeline: see Supported File Formats for everything it can open, and OCR & Transcription for reading text out of images, audio and video.
Metadata on every asset
Asset kind · message
| Field | Type | Always present | What it is |
|---|---|---|---|
| channel_id | string | Yes | Slack channel id |
| ts | string | Yes | Message timestamp |
| channel_name | string | No | Channel name |
| author | string | No | User id or bot name |
| thread_ts | string | No | Parent thread timestamp |
| reply_count | integer | No | Number of replies in this message's thread |
Asset kind · attachment
| Field | Type | Always present | What it is |
|---|---|---|---|
| filename | string | No | Original file name |
| mime_type | string | No | MIME type |
| size_bytes | integer | No | Raw byte size |
| channel_id | string | Yes | Slack channel id the file was shared in |
| file_id | string | Yes | Slack file id |
| file_name | string | Yes | Original file name |
| message_ts | string | No | Timestamp of the message the file was shared in |
| channel_name | string | No | Channel name |
| author | string | No | User id that shared the file |
Lineage
Lineage
This source records no lineage. Nothing in the system it reads describes data moving from one place to another, so no FLOW edges are produced. Related items are still linked — see Lineage & Relationships for what those links mean and how they differ from lineage.
Worth knowing
- Rate limits are handled for you — throttled responses are retried, and you can add a fixed pause between calls for very large workspaces.
- A finding points at the message, with its channel, author and timestamp, so triage starts with a permalink into Slack.
Configuration
Beyond the fields below, every source also has the settings shared by all of them: the sampling strategy, the detectors to run, the scan schedule, and the compute limits for its scan jobs.
Required
Without these, the source will not save.
| Field | Type | Required | What it does | Default |
|---|---|---|---|---|
| required | object | Yes | —no extra properties | — |
| workspace | string | No | Slack workspace name or domain, used for permalinks and stable asset IDs (example: acme or acme.slack.com) | — |
Secrets
Stored encrypted and never shown again after you save them. See Configuration & Fields.
| Field | Type | Required | What it does | Default |
|---|---|---|---|---|
| masked | object | Yes | Bot-token authentication. Install the app into the workspace and copy its bot token; user tokens are not supported.no extra properties | — |
| bot_token | string | Yes | Slack bot token, starts with xoxb-. Needs the scopes channels:read, groups:read, im:read, mpim:read, channels:history, groups:history, im:history, mpim:history, users:read and files:read. | — |
Optional
Everything you can tune. Sensible defaults apply when you leave them alone.
| Field | Type | Required | What it does | Default |
|---|---|---|---|---|
| optional | object | No | —no extra properties | — |
| attachments | object | No | Files shared in messages. Each file becomes its own asset, and its text is extracted with the same parser used for local files (PDF, Office, images via OCR, audio and video transcription).no extra properties | — |
| attachments.exclude_file_extensions | array | No | Skip files with these extensions (example: .mp4, .zip) | — |
| attachments.exclude_file_extensions[] | string | No | — | — |
| attachments.include_attachments | boolean | No | Emit files shared in messages as scannable assets | true |
| attachments.include_file_extensions | array | No | Only download files with these extensions (example: .pdf, .docx). Empty means all extensions. | — |
| attachments.include_file_extensions[] | string | No | — | — |
| attachments.max_attachment_bytes | integer | No | Skip files larger than this many bytes (default 25 MB)min 1024, max 524288000 | 26214400 |
| channels | object | No | Which conversations to discover and scan.no extra properties | — |
| channels.auto_join_public_channels | boolean | No | Join public channels the bot is not a member of before reading them. conversations.history returns not_in_channel otherwise. Requires the channels:join scope. | false |
| channels.channel_ids | array | No | Explicit conversation IDs to scan (example: C0123456789). When set, channel_types is ignored. | — |
| channels.channel_ids[] | string | No | — | — |
| channels.channel_types | array | No | Conversation types to include when listing channels. The bot only sees private channels and group DMs it has been invited to. | ["public_channel","private_channel","mpim","im"] |
| channels.channel_types[] | enum | No | Slack conversation types to include. public_channel and private_channel are named channels, mpim is a group direct message, im is a one-to-one direct message. Allowed: public_channel, private_channel, mpim, im | — |
| channels.exclude_archived | boolean | No | Skip archived channels when listing | true |
| ingestion | object | No | Throughput and message-content controls.no extra properties | — |
| ingestion.batch_size | integer | No | Messages requested per API call (Slack caps this at 200)min 1, max 200 | 200 |
| ingestion.include_thread_replies | boolean | No | Fetch each thread's replies and scan them alongside the parent message. Costs one extra API call per threaded message. | true |
| ingestion.rate_limit_delay_seconds | number | No | Extra pause between API calls. Slack's 429 responses are retried automatically; this only smooths out sustained traffic.min 0 | 1 |
| time_range | object | No | Limit ingestion to messages inside a time window.no extra properties | — |
| time_range.latest | string | No | End of the range, as a Slack timestamp or an ISO 8601 datetime | — |
| time_range.oldest | string | No | Start of the range, as a Slack timestamp or an ISO 8601 datetime | — |