Slack Securlet data stops showing in CloudSOC Investigate

Products

• CASB Securlet SAAS

Issue/Introduction

Slack Securlet is activated and shows data in Investigate tab in CloudSOC, but then the data stops.

Cause

The Slack Administrator that was used to activate the Securlet is removed or demoted in Slack

Resolution

The Slack Administrator cannot be removed or demoted from being administrator. This will cause the token used for the API calls to no longer work and gather the API data.

If necessary, create a Service account with administrator rights in Slack to use for the Slack Securlet Activation.