> ## Documentation Index
> Fetch the complete documentation index at: https://auth0-feat-docs-5564-security-agent.mintlify.site/llms.txt
> Use this file to discover all available pages before exploring further.

# Configure Security Agent

> Set up Security Agent and connect it to your Slack workspace to start monitoring your Auth0 tenant for identity attacks.

export const ReleaseStageNotice = ({feature, stage, plans, contact, terms}) => {
  const stageTextMap = {
    "beta": "Beta",
    "ea": "Early Access"
  };
  const stageText = stageTextMap[stage] || "a product release stage";
  const prsLink = "/docs/troubleshoot/product-lifecycle/product-release-stages";
  const linkify = (text, url) => {
    return <a href={url} target="_blank" rel="noreferrer" class="link">{text}</a>;
  };
  const includeDetails = (plans, contact, terms) => {
    const hasDetails = terms || plans || contact;
    if (!hasDetails) return null;
    return <span data-as="p">
            {plans && <>This feature is available for {linkify(`${plans} plans`, "https://auth0.com/pricing")}. </>}
            {contact && "To participate, contact " + contact + ". "}
            {terms && <>By using this feature, you agree to the applicable Free Trial terms in Okta's {linkify("Master Subscription Agreement", "https://www.okta.com/legal")}.</>}
        </span>;
  };
  return <Warning>
            <span data-as="p">
                <strong>The {feature} feature is in {linkify(stageText, prsLink)}.</strong>
            </span>

            {includeDetails(plans, contact, terms)}
        </Warning>;
};

<ReleaseStageNotice feature="Security Agent" stage="ea" contact="Auth0 Support or your Technical Account Team" terms={true} />

<Card title="Before you start">
  * Verify your account is on an Auth0 Enterprise plan with the Attack Protection enabled. To learn more, read [Manage your Auth0 Subscription Plan](/docs/troubleshoot/customer-support/manage-subscriptions).
  * Ensure your organization has an active Slack workspace.
  * If your organization enforces a Slack application approval policy, coordinate with your Slack administrator before starting. Approval can take several days.
  * Create a dedicated Slack channel for security alerts before you begin (for example, `#auth0-security-alerts`). Restrict access to this channel to your security team, as alert cards contain tenant-specific data including IP addresses and rate metrics.
</Card>

Configure the [Security Agent](/docs/secure/security-ai-agent) to monitor your Auth0 tenant for identity attacks and receive remediation recommendations in Slack.

For setup, you need a owner or administrator permissions to both Slack and your Auth0 tenant.

## Create the Slack application

<Callout icon="file-lines" color="#0EA5E9" iconType="regular">
  You need to access Auth0 Dashboard for the Slack application manifest to provide during Slack configuration.
</Callout>

The configuration in Auth0 Dashboard requires fields you generate in Slack. Follow the process to create a new Slack application with an application manifest to pre-configures the application's name, OAuth scopes, and the webhook endpoint used to communicate with Auth0.

1. Log in to [api.slack.com/apps](https://api.slack.com/apps).
2. Select **Create New App**.
3. Select **From a manifest**.
4. Choose your Slack workspace.
5. Paste in the manifest JSON provided in Auth0 Dashboard.
   <Callout icon="file-lines" color="#0EA5E9" iconType="regular">
     If you recieve an error message about URL verification, select the provided link to verify your Auth0 tenant URL. For example: `https://{YOUR_AUTH0_DOMAIN.auth0.com/icg/webhooks/slack}`
   </Callout>
6. Review the configuration and select **Create**.

## Collect application credentials

After you create the application, you need to collect three values from the Slack application settings page for configuring Security Agent in Auth0 Dashboard.

1. Navigate to **Basic Information** and copy the **App ID** and **Signing Secret**.
2. Navigate to **Install App** and copy the **Bot User OAuth Token**.

Provide these values to your Auth0 administrator along with the Channel ID from the Configure your Slack channel step.

## Install the application in your workspace

1. In the Slack application settings, navigate to **Install App**.
2. Select **Install to Workspace**.
3. Review the permission scopes and select **Allow**.

## Configure your Slack channel

1. Invite the bot to your dedicated security channel using `/invite @[bot-name]`.
2. Collect the Channel ID: select the channel name, then select **Settings > About**, and scroll to the bottom to find the Channel ID (format: `C01234ABCDE`).
3. Provide the Channel ID to your Auth0 administrator along with the credentials from the Collect application credentials step.

## Configure Security Agent in the Auth0 Dashboard

The Auth0 administrator completes the remaining steps.

1. Navigate to [**Auth0 Dashboard > Security > Attack Protection > Security Agent**](https://manage.auth0.com/#/security-agent).
2. Toggle on **Enable Security Agent**. Once you enable the Security Agent, it begins monitoring your tenant's traffic.
3. Enter the four values collected by the Slack administrator:
   * Slack App ID
   * Slack Signing Secret
   * Slack Bot Token
   * Channel ID
4. You have the option to create the required machine-to-machine application.

## Create the machine-to-machine application

Security Agent requires a machine-to-machine (M2M) application to access your tenant configuration with read-only permissions. The Security Agent configuration page prompts you to create one if none exists.

Select **Create M2M App** on the configuration page. This application gives Security Agent read-only access to your Attack Protection settings, Tenant ACL rules, and the data used to generate recommendations.

<Callout icon="file-lines" color="#0EA5E9" iconType="regular">
  If the M2M application is deleted from your tenant after setup, the configuration page will show an error. Return to the configuration page to recreate it.
</Callout>

## Verify setup

In your designated Slack channel, type `@[bot-name]` to mention the bot. If the bot responds with a help message, setup is complete.

If the bot does not respond, verify the following in [**Auth0 Dashboard > Security > Attack Protection > Security Agent**](https://manage.auth0.com/#/security-agent):

* The App ID, Signing Secret, Bot User OAuth Token, and Channel ID are entered and saved correctly. A copy-paste error such as a trailing space is the most common cause.
* The **Enable Security Agent** toggle is on.
* The M2M application is active.

## Secure Agent anomaly alert

When anomalies are detected, such as a spike in traffic, the Slack channel you created generates a new message to prompt Slack administrators to investigate.

Once you select **Investigate with Agent**, Security Agent compiles threat intelligence and correlated signals based on your Auth0 tenant's Attack Protection and Tenant Access Control List (ACL) configuration. A summary triage report give you the opportunity to select **View Full Triage Report** or **View Recommendations**.

The full triage report is a complete timeline with details including Agent analysis of the incident. From the full report, select **View Recommendations** for mitigation strategies.

### Security Agent recommendations

To generate recommendations, Security Agent cross-referenecs attack data with your tenant's Attack Protection and ACL configuration for suggestions on increasing your security posture to mitigate the threat. Administrators review remediation suggestions and justifications, but can select **View Details** to review the specific recommendations.

Slack Admins can use Auth0 Dashboard or Management API to apply suggestions or select **Apply via Agent** and follow a standard OAuth authentication flow for the agent to apply changes.

Once changes are applied by Security Agent, the next Slack message specifies the actions taken, the administator who approved the recommended changes, and provides the opportunity to **Rerun Triage Report** to measure the impact.

<Warning>
  We recommend you wait one (1) hour before you rerun the triage report to give the strategy time to remediate the attack pattern.
</Warning>

## Learn more

* [Security Agent](/docs/secure/security-ai-agent)
* [Attack Protection](/docs/secure/attack-protection)
* [Tenant Access Control List (ACL)]()