Skip to main content

Before you start

  • Verify your account is on an Auth0 Enterprise plan with the Attack Protection enabled. To learn more, read Manage your Auth0 Subscription Plan.
  • Ensure your organization has an active Slack workspace.
  • If your organization enforces a Slack application approval policy, coordinate with your Slack administrator before starting. Approval can take several days.
  • Create a dedicated Slack channel for security alerts before you begin (for example, #auth0-security-alerts). Restrict access to this channel to your security team, as alert cards contain tenant-specific data including IP addresses and rate metrics.
Configure the Security Agent to monitor your Auth0 tenant for identity attacks and receive remediation recommendations in Slack. For setup, you need a owner or administrator permissions to both Slack and your Auth0 tenant.

​
Create the Slack application

You need to access Auth0 Dashboard for the Slack application manifest to provide during Slack configuration.
The configuration in Auth0 Dashboard requires fields you generate in Slack. Follow the process to create a new Slack application with an application manifest to pre-configures the application’s name, OAuth scopes, and the webhook endpoint used to communicate with Auth0.
  1. Log in to api.slack.com/apps.
  2. Select Create New App.
  3. Select From a manifest.
  4. Choose your Slack workspace.
  5. Paste in the manifest JSON provided in Auth0 Dashboard.
    If you recieve an error message about URL verification, select the provided link to verify your Auth0 tenant URL. For example: https://{YOUR_AUTH0_DOMAIN.auth0.com/icg/webhooks/slack}
  6. Review the configuration and select Create.

​
Collect application credentials

After you create the application, you need to collect three values from the Slack application settings page for configuring Security Agent in Auth0 Dashboard.
  1. Navigate to Basic Information and copy the App ID and Signing Secret.
  2. Navigate to Install App and copy the Bot User OAuth Token.
Provide these values to your Auth0 administrator along with the Channel ID from the Configure your Slack channel step.

​
Install the application in your workspace

  1. In the Slack application settings, navigate to Install App.
  2. Select Install to Workspace.
  3. Review the permission scopes and select Allow.

​
Configure your Slack channel

  1. Invite the bot to your dedicated security channel using /invite @[bot-name].
  2. Collect the Channel ID: select the channel name, then select Settings > About, and scroll to the bottom to find the Channel ID (format: C01234ABCDE).
  3. Provide the Channel ID to your Auth0 administrator along with the credentials from the Collect application credentials step.

​
Configure Security Agent in the Auth0 Dashboard

The Auth0 administrator completes the remaining steps.
  1. Navigate to Auth0 Dashboard > Security > Attack Protection > Security Agent.
  2. Toggle on Enable Security Agent. Once you enable the Security Agent, it begins monitoring your tenant’s traffic.
  3. Enter the four values collected by the Slack administrator:
    • Slack App ID
    • Slack Signing Secret
    • Slack Bot Token
    • Channel ID
  4. You have the option to create the required machine-to-machine application.

​
Create the machine-to-machine application

Security Agent requires a machine-to-machine (M2M) application to access your tenant configuration with read-only permissions. The Security Agent configuration page prompts you to create one if none exists. Select Create M2M App on the configuration page. This application gives Security Agent read-only access to your Attack Protection settings, Tenant ACL rules, and the data used to generate recommendations.
If the M2M application is deleted from your tenant after setup, the configuration page will show an error. Return to the configuration page to recreate it.

​
Verify setup

In your designated Slack channel, type @[bot-name] to mention the bot. If the bot responds with a help message, setup is complete. If the bot does not respond, verify the following in Auth0 Dashboard > Security > Attack Protection > Security Agent:
  • The App ID, Signing Secret, Bot User OAuth Token, and Channel ID are entered and saved correctly. A copy-paste error such as a trailing space is the most common cause.
  • The Enable Security Agent toggle is on.
  • The M2M application is active.

​
Secure Agent anomaly alert

When anomalies are detected, such as a spike in traffic, the Slack channel you created generates a new message to prompt Slack administrators to investigate. Once you select Investigate with Agent, Security Agent compiles threat intelligence and correlated signals based on your Auth0 tenant’s Attack Protection and Tenant Access Control List (ACL) configuration. A summary triage report give you the opportunity to select View Full Triage Report or View Recommendations. The full triage report is a complete timeline with details including Agent analysis of the incident. From the full report, select View Recommendations for mitigation strategies.

​
Security Agent recommendations

To generate recommendations, Security Agent cross-referenecs attack data with your tenant’s Attack Protection and ACL configuration for suggestions on increasing your security posture to mitigate the threat. Administrators review remediation suggestions and justifications, but can select View Details to review the specific recommendations. Slack Admins can use Auth0 Dashboard or Management API to apply suggestions or select Apply via Agent and follow a standard OAuth authentication flow for the agent to apply changes. Once changes are applied by Security Agent, the next Slack message specifies the actions taken, the administator who approved the recommended changes, and provides the opportunity to Rerun Triage Report to measure the impact.
We recommend you wait one (1) hour before you rerun the triage report to give the strategy time to remediate the attack pattern.

​
Learn more