Skip to main content

Slack Notification

Use Slack Notification to create reusable notification endpoints that Cloudaware workflows, policies, and events can call.

info
  • Audience: Cloudaware administrators, SecOps teams, SRE teams, and workflow administrators
  • Outcome: Cloudaware flows can send selected alerts, changes, and operational updates to Slack channels

Capabilities​

The integration supports:

  • Slack messages sent from Cloudaware flows, policies, and events
  • Notification delivery through a Slack Cloudaware Application connection
  • Notification delivery through a Slack incoming webhook URL that you create and manage in Slack
  • Reusable Slack Notification configurations for multiple Cloudaware automation flows

Prerequisites​

Before you begin, make sure you have:

  • Access to a Cloudaware account.
  • A user with access to the Admin Console and permissions to manage cloud accounts, organizations, and integrations (Cloudaware Administrator).
  • A Slack channel designated for Cloudaware notifications, for example, #cloudaware-alerts or #secops.
  • One of the following:

Configure a Slack Notification in Cloudaware​

Use case: The SecOps want to receive Slack notifications whenever an inbound rule in any AWS EC2 Security Group allows unrestricted access (e.g., from 0.0.0.0/0 or ::/0), indicating a potential security risk.

Slack Webhook URL​

Use the Slack Webhook URL option when your team manage incoming webhooks directly in Slack.

  1. In Cloudaware, go to Admin.
  2. Find Slack Notification, then click + ADD.
  3. Provide a display name for the Slack Notification integration.
  4. Choose the Slack delivery method:
    • Slack Webhook URL: Enter the Slack incoming webhook URL.
  5. Enter the following values:
    • Message: The Slack message template. Use expressions to reference Cloudaware object fields.
    • Object Name: (optional) An expression used as the message title or object label.
    • Color: (optional) An expression-based value used to indicate severity or status.
    • URL Base: (optional) An expression or URL base that links the Slack message back to Cloudaware or another target.
    • Fields List:
  6. Click Save.
  7. Confirm that the integration status indicator is green.
tip

To get the webhook URL in Slack:

  1. Log in to the Apps Directory in Slack → Incoming Webhooks → toggle Activate Incoming Webhooks to on → Add New Webhook to Workspace.
  2. Grant your App necessary permissions and select the Slack channel where notifications will be posted. Click Authorize.
  3. Copy and save the Webhook URL to use it in Cloudaware.

Integrated Slack Application​

Use the Slack Cloudaware Application option when you want Cloudaware to manage Slack app authorization.

  1. In Cloudaware, go to Admin.
  2. Find Slack Notification, then click + ADD.
  3. Provide a display name for the Slack Notification integration.
  4. Choose the Slack delivery method:
    • Slack Cloudaware Application: Select the Cloudaware-managed Slack app.
  5. Enter the following values:
    • Integrated Slack Application: Select the authorized Slack app configuration from the list.
    • Message: The Slack message template. Use expressions to reference Cloudaware object fields.
    • Color: (optional) An expression-based value used to indicate severity or status.
    • URL Base: (optional) An expression or URL base that links the Slack message back to Cloudaware or another target.
    • Fields List: Specify the fields that should be excluded from a Slack message (in this example, Name)
  6. Click Save.
  7. Confirm that the integration status indicator is green.
  8. Copy and save the Endpoint URL for further configuration.
tip

Object Name, Message, Color, Url Base are expression fields. The data type of the returned value depends on the elements used in the expression.

Note on sObject Reference Syntax​

Pay attention to the sObject reference syntax. The data type of the value returned depends on the elements used in the input.

Here are sample outputs:

InputOutputComment
This is a textThis is a text
sObject.Name<ci_name_field_value>Display the actual CI name, e.g. sgr-0243db1b9253cc749 for AWS EC2 Security Group Rule
'Hey, ' + sObject.NameHey, <ci_name_field_value>Plain text must be enclosed in quotes when combined with a CI record reference
'*AWS EC2 Security Group Rule ID*: \n*' +
sObject.CA10__securityGroupRuleId__c +
'*'		AWS EC2 Security Group Rule ID:

<ci_ec2_security_group_rule_id_value>
  • Use asterisks to format the field value in bold (more about special text formatting in Jira)
  • Use newline characters \n to add line breaks
-IdUse - to exclude fields from the default description*
sObject.CA10_severity_c== “High”?
‘danger’ : ‘good’		danger/good

Use Slack Notification in Cloudaware Flows​

Slack Notification integrations are typically invoked from Cloudaware flows, policies, or events when conditions you define are met. Typical examples include:

  • Vulnerability with severity High or Critical is created or updated.
  • Cost anomaly is detected for a specific account or application.
  • Configuration baseline change or policy violation is found.
  • A custom object, such as an upgrade request, transitions to a specific state.

In these flows:

  1. Build the rule or policy that identifies the condition.
  2. Add an action that calls the relevant Slack Notification integration.
  3. Use message expressions to include key fields, such as object name, severity, affected instance, and links back to Cloudaware.

Troubleshooting​

Slack Messages Are Not Delivered​

  • Confirm that the Slack Notification integration status indicator is green.
  • Verify that the Slack Cloudaware Application or incoming webhook URL is still valid.
  • Confirm that the destination channel exists and accepts messages from the selected Slack app or webhook.
  • Review the Cloudaware flow or policy criteria to confirm that the notification action is being triggered.

Message Content Is Missing Fields​

  • Verify that the expressions in Message, Object Name, URL, and Color use valid Cloudaware field API names.
  • Confirm that the triggering record contains values for the referenced fields.
  • Test with a simple static message to isolate template or field-expression issues.

Reconfigure or Remove the Integration​

warning

To change message templates, channel routing, or webhook details, edit the existing Slack Notification instead of deleting and re-creating it when possible.

Update the Integration Details​

  1. Go to Admin.
  2. Select Slack Notification.
  3. Select the specific integration.
  4. Open the three-dot menu (⋮), then click Edit.
  5. Update the required fields.
  6. Click Save.

Remove the Integration from Cloudaware​

  1. Go to Admin.
  2. Select Slack Notification.
  3. Select the specific integration.
  4. Open the three-dot menu (⋮), then click Delete.
  5. Confirm the deletion if prompted.

Security Notes​

  • Treat Slack webhook URLs as secrets. Do not share them in tickets, chat, or documentation.
  • Route sensitive alerts only to approved Slack channels with appropriate membership.
  • Review message templates before enabling flows, because Cloudaware fields may include asset identifiers, account details, vulnerability context, or operational metadata.
  • Limit Slack Notification administration to approved Cloudaware administrators.
  • Rotate or replace incoming webhook URLs if they are exposed or no longer meet workspace policy.
  • Remove unused Slack Notification configurations when flows or channels are retired.