The format of the object IDs in Slack Securlet

Products

• CASB Securlet SAAS
• CASB Securlet SAAS With DLP-CDS
• CASB Security Standard
• CASB Security Premium
• CASB Security Advanced IAAS
• CASB Security Advanced

Issue/Introduction

The Object IDs populated by Slack Securlet has different formats and it consists of different parts. this article clarifies some of them.

Resolution

The Object IDs in Slack consists of a prefix letter which signifies the type of the object followed by an alphanumerical value representing the identified.

 

Here are a few examples:

USER ID :

For a standard user account, the ID starts with either letter 'U' or 'W', like U012AB345CD 

For a Bot User account, the user ID starts with letter 'B'  like B012AB345CD

CHANNEL ID:

Starts with either letters 'C' 'G' or 'D' , ( typically 'C' for public channels , 'G' for private channels and 'D' for direct channels),

example would be C012QRSTUW9

TEAM ID: 

Starts with letter 'T', like T012AB345CD

WORKFLOW ID:

Starts with 'Wf', like Wf01ABC2D3EF

APP ID:

Starts with letter 'A', like A01ABCDEF2G

FILE ID (and CANVAS ID):

Starts with letter 'F', like F01AABBC9DD

INSTNACE ID:

Starts with letter 'E', like E012AB34CD5

 

Slack Securlet reports all of the above object as they are, except in two cases:

FILE ID (and CANVAS ID):

File ID would be reported directly as Slack like F01AABBC9DD , or 

In this format: <DocID>_<Instance_ID> 

example: F01AABBC9DD_E012AB34CD5

 

MESSAGE ID:

reported in this format : <team_id> _ <channel_id> _ <user id> _ <block timestamp>

example: T012AB345CD_C012QRSTUW9_U012AB345CD_1727122245