Sending USM Anywhere Notifications to Slack

Role Availability Read-Only Investigator Analyst Manager

From USM Anywhere, you can send an alarm or event notification to a Slack channel to alert team members. This facilitates communication and collaboration within the same messaging tool that your organization uses for incident response Incident response is a business process or plan dictating how an organization handles security incidents such as a security breach or attack.. When you have this integration configured in USM Anywhere, you can create orchestration rules to automatically send these notifications when an event Any traffic or data exchange detected by LevelBlue products through a sensor or external devices such as a firewall. or alarm Alarms provide notification of an event or sequence of events that require attention or investigation. matches the rule criteria.

Edition: The Notification integrations are available in the Standard and Premium editions of USM Anywhere.

See the Affordable pricing to fit every budget page for more information about the features and support provided by each of the USM Anywhere editions.

Note: While the direct integration with USM Anywhere is the easiest and most straightforward way to send messages to your Slack team from USM Anywhere, you can use the Amazon Simple Notification Service (SNS) messaging service as an alternative.

In this case, you create the webhook in Slack and then set up the integration in the Lambda function that you created in Amazon Web Services (AWS) to support USM Anywhere messaging. See Sending Notifications Through Amazon SNS and Set Up a Slack Integration through Amazon SNS for more information.