ZSCALER AND SLACKDEPLOYMENT GUIDEAUGUST 2023, VERSION 1.2

BUSINESS DEVELOPMENT GUIDEZscaler and Slack Deployment Guide

Contents
Terms and Acronyms

6

Trademark Notice7

About This Document

8

Zscaler Overview

8

Slack Overview

8

Audience

8

Software Versions

8

Request for Comments

8

Zscaler and Slack Introduction

9

ZIA Overview

9

ZDX Overview

9

ZPC Overview

9

Zscaler Resources

10

Slack Overview

11

Slack Resources

11

Zscaler Data Protection and Digital Experience for Slack.com

12

ZIA SaaS Identity Proxy13

ZIA Tenant Profiles and Tenancy Restrictions

14

ZIA SaaS Security API Data and Malware Protection for Slack

14

What makes Zscaler SaaS Security unique?

ZDX for the Slack User Experience
What makes ZDX unique?

15

15
16

©2024 Zscaler, Inc. All rights reserved.

2

Zscaler and Slack Deployment Guide

Configure the SaaS Identity Proxy
Configure the ZIA Admin Portal for the SaaS Identity Proxy
Configure the SaaS Identity Proxy

17
18
19

Configure Slack to use the Identity Proxy20

Configure Slack Single Sign-On

21

Configure Slack Single Sign-On

22

The Completed Slack Configuration

23

User Informational EmailThe Zscaler Active Identity Proxy Notification

Configuring Tenancy Restrictions for Slack

24

25

26

Create a Tenant Profile

27

Cloud Application Control Policy Wizard

28

Completed Tenant Restrictions

29

Tenant Restriction Alerts

30

Configuring the Slack Tenant

31

Adding the Slack Tenant

32

SaaS Tenant Configuration Wizard

33

SaaS Tenant Configuration Wizard

34

Configuring the Zscaler Tenant on Slack

35

Configuring the Zscaler Tenant on Slack36

The Active Slack Tenant

38

Configuring Slack Policies and Scan Configuration

39

Scoping the Policies and Remediation

40

Creating a DLP Policy

41

Creating a DLP Engine

42

Creating a DLP Engine

43©2024 Zscaler, Inc. All rights reserved.

3

Zscaler and Slack Deployment Guide

Configure a SaaS DLP Policy

44

SaaS DLP Policy Details

45

Configure a SaaS DLP Policy

46

Configure a SaaS Malware Policy

48

SaaS Malware Detection Policy Wizard
SaaS Malware Detection Policy

Configure the Scan Schedule Configuration
Start the Scan Schedule

Reporting and Visibility

49
50

51
52

53

SaaS Assets and SaaS Assets Summary Report

54

SaaS Security Insights

55

Zscaler Digital Exchange (ZDX) for SlackLog in to ZDXConfigure ZDX for Slack

Configure ZDX Probes for Slack

56
57
58

60

Configure Probes for Slack Monitoring

65

Configure ZDX Probes for Slack67

The ZDX-Enabled Slack Application

69

Create an Alert for the Slack Service

70

Create an Alert for the Slack Service

71

The Triggered Alert for the Slack Service

76

Alert Detail for the Slack Service

77

The Sent Alert Email for the Slack Service

78

Using the ZDX Dashboard
Application Overview and Performance Detail
Slack Application Performance Detail

79
80
81

©2024 Zscaler, Inc. All rights reserved.

4

Zscaler and Slack Deployment Guide

User Overview and Detail

83

Slack User Detail

84

User Detail

85

Zscaler Posture Control (ChatOps) and SlackPrerequisites

86
86

Integrating ZPC and Slack92

Create Notification Rules

94

Create a Cloud Notification Rule95

Analyzing ZPC Alerts in Slack97

Appendix A: Requesting Zscaler Support

98

Requesting Help via ZIA

98

Requesting Zscaler Support via ZPC

100©2024 Zscaler, Inc. All rights reserved.

5

Zscaler and Slack Deployment Guide

Terms and Acronyms
The following table defines acronyms used in this deployment guide. When applicable, a Request for Change (RFC) is
included in the Definition column for your reference.
Acronym
CA
CI/CD
CRM
CSV
DLP
DNS
DPD
GRE
ICMP
IdP
IKE
IPS
IPSec
PFS
PSK
SaaS
SSL
TLS
VDI
XFF
ZCP
ZDX
ZIA
ZPA

Definition
Central Authority (Zscaler)Continuous integration and continuous delivery
Customer Relationship Management
Comma-Separated Values
Data Loss Prevention
Domain Name Service
Dead Peer Detection (RFC 3706)
Generic Routing Encapsulation (RFC2890)
Internet Control Message Protocol
Identity Provider
Internet Key Exchange (RFC2409)
Intrusion Prevention System
Internet Protocol Security (RFC2411)
Perfect Forward Secrecy
Pre-Shared Key
Software as a Service
Secure Socket Layer (RFC6101)
Transport Layer Security
Virtual Desktop Infrastructure
X-Forwarded-For (RFC7239)
Zscaler Cloud Protection (Zscaler)
Zscaler Digital Experience (Zscaler)
Zscaler Internet Access (Zscaler)
Zscaler Private Access (Zscaler)©2024 Zscaler, Inc. All rights reserved.

6

Zscaler and Slack Deployment Guide

Trademark Notice© 2023 Zscaler, Inc. All rights reserved. Zscaler™ and other trademarks listed at zscaler.com/legal/trademarks are either (i)registered trademarks or service marks or (ii) trademarks or service marks of Zscaler, Inc. in the United States and/or othercountries. Any other trademarks are the properties of their respective owners.

©2024 Zscaler, Inc. All rights reserved.

7

Zscaler and Slack Deployment Guide

About This Document
The following sections describe the organizations and requirements of this deployment guide.

Zscaler Overview
Zscaler (NASDAQ: ZS) enables the world’s leading organizations to securely transform their networks and applications fora mobile and cloud-first world. Its flagship Zscaler Internet Access (ZIA) and Zscaler Private Access (ZPA) services create
fast, secure connections between users and applications, regardless of device, location, or network. Zscaler delivers its
services 100% in the cloud and offers the simplicity, enhanced security, and improved user experience that traditional
appliances or hybrid solutions can’t match. Used in more than 185 countries, Zscaler operates a massive, global cloudsecurity platform that protects thousands of enterprises and government agencies from cyberattacks and data loss. To
learn more, see Zscaler’s website.

Slack Overview
Slack (NYSE: WORK) transformed business communication. It’s the leading channel-based messaging platform, used bymillions to align their teams, unify their systems, and drive their businesses forward. Only Slack offers a secure, enterprisegrade environment that can scale with the largest companies in the world. It is a new layer of the business technology
stack where people can work together more effectively, connect all their other software tools and services, and find theinformation they need to do their best work. Slack is where work happens. To learn more, refer to Slack’s website.

Audience
This guide is for network administrators, endpoint and IT administrators, and security analysts responsible for deploying,monitoring, and managing enterprise security systems. For additional product and company resources, see:•

Zscaler Resources•

Slack Resources•

Appendix A: Requesting Zscaler Support

Software Versions
This document was authored using the latest version of Zscaler software.

Request for Comments•

For prospects and customers: Zscaler values reader opinions and experiences. Contact partner-doc-support@
zscaler.com to offer feedback or corrections for this guide.

•For Zscaler employees: Contact z-bd-sa@zscaler.com to reach the team that validated and authored theintegrations in this document.

©2024 Zscaler, Inc. All rights reserved.

8

Zscaler and Slack Deployment Guide

Zscaler and Slack Introduction
Overviews of the Zscaler and Slack applications are described in this section.
you are using this guide to implement a solution at a government agency, some of the content might be
exclamation-triangle Ifdifferent
for your deployment. Efforts are made throughout the guide to note where government agencies mightneed different parameters or input. If you have questions, please contact your Zscaler Account team.

ZIA Overview
ZIA is a secure internet and web gateway delivered as a service from the cloud. Think of ZIA as a secure internet onramp—just make Zscaler your next hop to the internet via one of the following methods:•

Setting up a tunnel (GRE or IPSec) to the closest Zscaler data center (for offices).

•

Forwarding traffic via lightweight Zscaler Client Connector or PAC file (for mobile employees).

No matter where users connect—a coffee shop in Milan, a hotel in Hong Kong, or a VDI instance in South Korea—they get
identical protection. ZIA sits between your users and the internet and inspects every transaction inline across multiple
security techniques (even within SSL).
You get full protection from web and internet threats. The Zscaler cloud platform supports Cloud Firewall, IPS,
Sandboxing, DLP, and Isolation, allowing you to start with the services you need now and activate others as your needs
grow.

ZDX Overview
ZDX is a digital experience monitoring solution delivered as a service from the Zscaler cloud. ZDX provides end-toend visibility and troubleshooting of end-user performance issues for any user or application, regardless of location. In
addition, it enables continuous monitoring for network, security, desktop, and helpdesk teams with insight into the enduser device, network, and application performance issues. With ZDX, IT teams can proactively analyze and troubleshootuser experience issues, improving business productivity and IT agility.

ZPC Overview
Zscaler Posture Control (ZPC) is a multi-tenant Software as a Service (SaaS) platform that detects and responds to cloudsecurity risks. The service enables your organization to correlate across multiple security engines to prioritize hidden risks
caused by misconfigurations, threats, and vulnerabilities, and achieve continuous security, compliance, and governance.
ZPC leverages cloud service provider APIs to connect to your hybrid, multi-cloud environments and collect real-time
configuration metadata for your cloud infrastructure, such as web servers, databases, and virtual machines. ZPC evaluates
the metadata and offers visibility into your security, compliance, and risk posture.
ZPC includes:•

Cloud Security Posture Management (CSPM): Ensure cloud resources have proper configurations for authentication,
data encryption, internet connectivity, and more for compliance and a strong security posture.

•

Cloud Infrastructure Entitlement Management (CIEM): Identify and remediate excessive permissions that humans
and machines have by using machine learning analysis for increased visibility into access policies, resource policies,
actions, and roles.

•

Security and Compliance: Benchmark and validate public cloud configurations against best practices standards andcompliance frameworks to report misconfigurations, policy violations, and automate remediation.
©2024 Zscaler, Inc. All rights reserved.

9

Zscaler and Slack Deployment Guide•

Infrastructure as Code (IaC) Security: Monitor your IaC infrastructure and implement security controls to address any
misconfigurations or security issues before deployment and thereby ensure the code is secure and compliant withstandard security policies.

•

Vulnerability Management: Monitor and detect any known vulnerabilities and security weaknesses in the cloudinfrastructure and take immediate action to protect networks from potential threats.

Zscaler Resources
The following table contains links to Zscaler resources based on general topic areas.
Name
ZIA Help Portal
ZPC Help Portal
ZDX Help Portal
Zscaler Tools
Zscaler Training and Certification
Submit a Zscaler Support Ticket

Definition
Help articles for ZIA.
Help articles for ZPC.
Help Articles for ZDX.
Troubleshooting, security and analytics, and browser extensions that help
Zscaler determine your security needs.
Training designed to help you maximize Zscaler products.
Zscaler Support portal for submitting requests and issues.

The following table contains links to Zscaler resources for government agencies.
Name
ZIA Help Portal
ZPC Help Portal
ZDX Help Portal
Zscaler Tools
Zscaler Training and Certification
Submit a Zscaler Support Ticket

Definition
Help articles for ZIA.
Help articles for ZPC.
Help Articles for ZDX.
Troubleshooting, security and analytics, and browser extensions that help
Zscaler determine your security needs.
Training designed to help you maximize Zscaler products.
Zscaler Support portal for submitting requests and issues.

©2024 Zscaler, Inc. All rights reserved.

10

Zscaler and Slack Deployment Guide

Slack Overview
Slack is a messaging app for business that connects people to the information they need. By bringing people together towork as one unified team, Slack transforms the way organizations communicate.
•

Connected. Slack simplifies access to your colleagues—message anyone inside or outside your organization andcollaborate just like you would in person. People can work in dedicated spaces called channels that bring together
the right people and information.

•

Flexible. Slack supports asynchronous work. When work is organized in channels, no matter your location, time zone,
or function, you can access the information you need on your own time. Ask questions, get caught up, and share
updates without having to coordinate schedules.

•

Inclusive. In Slack, everyone in an organization has access to the same shared and searchable information. Whenteams work together in channels, information can be shared with everyone at once, helping keep teams stay aligned
and make decisions more quickly.

Slack Resources
The following table contains links to Slack support resources.
Name
About Slack
Slack Product Documentation
Slack Community
Slack Resources

Definition
Information about Slack Technologies.
Online help for Slack products.
Online community for Slack product help and technical questions.
Browse resources tailored to your team, your needs, and all the ways you can get
more out of Slack.

©2024 Zscaler, Inc. All rights reserved.

11

Zscaler and Slack Deployment Guide

Zscaler Data Protection and Digital Experience for Slack.com
Slack an industry leader that helped define the advantages that the cloud and SaaS applications offer enterprises.
SaaS services facilitate collaboration, simple tool access, and enables information sharing globally. But the downsideof this ease of access and sharing is security vulnerabilities based on the client’s environment. It is impossible to train
every employee to consistently use SaaS application best security practices, which can lead to costly mistakes for theorganization. Risk associated with accidental data exposure, malicious intent, and compliance violations can force
companies to restrict or prevent use of these incredible business tools.
Another challenge organizations face when migrating to today’s cloud services is monitoring user experience, especially intoday’s work-from-anywhere corporate environments.
Zscaler provides a complete Slack solution using Zscaler Internet Services (ZIA) for security and Zscaler Digital Experience(ZDX) for user experience visibility.

Figure 1. Zscaler solutions for Slack

ZIA provides Slack SaaS security by using access control, identity control, SaaS security, and Zscaler’s SaaS Security API toscan the Slack attachments for malicious content and data loss. ZIA also provides complete security for clients, whether
they are in the corporate office or their home office.
ZDX monitors the user specific experience and provides visibility to the Slack service to help organizations address any
user experience concerns or challenges. ZDX provides performance monitoring and measurements from the user device
running the Zscaler Client Connector. These monitors provide detailed information on user devices, the network path to
Slack, and the Slack SaaS performance itself. This information is invaluable to operations when a user is experiencing Slackissues by providing visibility to every corner of the internet.
Both ZIA SaaS security and ZDX SaaS monitoring operate as separate stand-alone services and are not dependent on
one or the other. However, the two services working together provide a comprehensive solution for both security andoperations of the partner SaaS CRM service.
©2024 Zscaler, Inc. All rights reserved.

12

Zscaler and Slack Deployment Guide

This guide covers the following ZIA security features and ZDX performance visibility features when using Slack:•

SaaS Identity Proxy•

Tenant Profiles and Tenancy Restrictions•

SaaS Security API Data and Malware Protection for Slack•ZDX for the Slack User Experience

ZIA SaaS Identity Proxy
You can configure the Zscaler service as an identity proxy for Slack. This Zscaler feature forces users to authenticate andaccess Slack only through the Zscaler ZIA security cloud. This provides security, inspection of traffic, and controlled accessfor all users of your organization’s Slack tenant.
When users try to access Slack with their corporate accounts without going through the Zscaler service, a window
displays asking them to login via Zscaler. The process is controlled using SAML, the IdP that is defined on Zscaler for the
ZIA service, and the Slack SSO configuration to forward auth requests to Zscaler. After the user’s identity is verified, theirtraffic to and from Slack is secured and the user and the Slack data is inspected using ZIA.

Figure 2. ZIA identity proxy

ZIA sits between your users and Slack, inspecting every byte of traffic inline across multiple security techniques (evenwithin SSL). You get full protection from web and internet threats. With a cloud platform that supports cloud firewall,
cloud IPS, cloud sandbox, cloud DLP, and cloud browser isolation, you can start with the services you need today andactivate others as your needs grow.

©2024 Zscaler, Inc. All rights reserved.

13

Zscaler and Slack Deployment GuideZIA Tenant Profiles and Tenancy Restrictions
Zscaler’s tenancy restrictions feature allows you to restrict access either to personal accounts, business accounts, or bothfor Slack. It consists of two parts: creating a tenant profile and then associating it with Cloud App Control policy rules.
By defining granular policies based on tenant profile, user group, department, or a number of other controls, you caneffectively manage user access for Slack to specific tenants relative to the user’s and organization’s business requirements.

Figure 3. ZIA tenancy restrictions in use with SlackYou can combine ZIA tenant restrictions with identity proxy to provide extra security to Slack users by assuring theidentity of the user. This guarantees user traffic is scanned and secured with the ZIA security features.

ZIA SaaS Security API Data and Malware Protection for Slack
The Zscaler SaaS Security API is a feature set that is part of the ZIA security cloud. It is designed specifically to help
manage the risks of the collaboration SaaS partners by preventing data exposure and ensuring compliance across the
SaaS application.
Zscaler SaaS Security enables organizations to securely adopt and govern the use of multiple SaaS applications. It
provides real-time visibility and controls access and user activity across sanctioned and unsanctioned applications. The
fully integrated platform eliminates overlay architectures and simplifies policy creation and administration, ensuring data
is protected and compliance is maintained.

Figure 4. ZIA SaaS Security API in use with Slack©2024 Zscaler, Inc. All rights reserved.

14

Zscaler and Slack Deployment Guide

What makes Zscaler SaaS Security unique?
•

Data exposure reporting and remediation. Zscaler SaaS Security checks SaaS applications and cloud provider
configurations and compares them to industry and organizational benchmarks to report on violations and automate
remediation.

•

Threat identification and remediation. Zscaler SaaS Security checks SaaS applications for hidden threats andprevents their propagation.

•

Compliance assurance. Zscaler SaaS Security provides compliance visibility across SaaS and cloud providers and canmitigate violations automatically.

•

Part of a larger data protection platform. The Zscaler Cloud Security platform provides unified data protection with
DLP, malware scanning capabilities (for internet, data center, and SaaS applications), and ensures that public cloud
applications are configured to prevent data exposure and maintain compliance. Zscaler also offers ZPA for Zero
Trust access to internal applications, ZDX for active monitoring SaaS application user experience, and Zscaler Cloud
Protection (ZCP). Zscaler provides end-to-end connectivity, security, and visibility from any location on-premises orremote.

For more information, see the resources in Zscaler Resources.

ZDX for the Slack User Experience
With ZDX, you can easily monitor user digital experiences. ZDX provides visibility across the complete user-to-cloud
app experience and quickly isolates issues. ZDX provides you with innovative and unprecedented end-to-end visibility,
regardless of network or location.

Figure 5. ZDX in use with Slack©2024 Zscaler, Inc. All rights reserved.

15

Zscaler and Slack Deployment Guide

What makes ZDX unique?
•End-user device performance. Gather and analyze data on end-user device resources that impact the end-user
experience.

•

Cloud path performance. Measure and analyze end-to-end and hop-by-hop network path metrics from every user
device to the cloud application.

•

Application performance. Continuously monitor and measure application metrics, such as response time, DNS
resolution, and broader availability metrics of the application.

•

ZDX scoring. Monitor aggregated user experience performance scores tracked over time at the user, application,
location, department, and organizational level.

For more information, see the resources in Zscaler Resources.

©2024 Zscaler, Inc. All rights reserved.

16

Zscaler and Slack Deployment Guide

Configure the SaaS Identity Proxy
Log into the Zscaler tenant with administrator credentials.

Figure 6. ZIA Admin Portal login©2024 Zscaler, Inc. All rights reserved.

17

Zscaler and Slack Deployment Guide

Configure the ZIA Admin Portal for the SaaS Identity Proxy
To configure Zscaler for the SaaS identity proxy:
1. Go to Administration > Identity Proxy Settings.
2. Select Add Cloud Application. The configuration wizard is displayed.
3. Give the cloud application a Name.
4. Select Enable the Status.
5. Select Slack for Cloud Application.
6. Set the ACS URL to https://your-slack-instance.com/sso/saml.
7. Set the Entity ID to https://slack.com.
8. Select the saml_2022 or later signing certificate.
9. Select Pass-through Zscaler Identity for Identity Transformation.
10. Click Save.

Figure 7. Configure the SaaS identity proxy settings©2024 Zscaler, Inc. All rights reserved.

18

Zscaler and Slack Deployment Guide

Configure the SaaS Identity Proxy
This is the completed identity proxy configuration on the ZIA Admin Portal.
1. Copy and save the Identity Proxy URL.
2. Copy and save the Issuer Entity ID.
3. Download and save the Signing Certificate.

Figure 8. The completed identity proxy©2024 Zscaler, Inc. All rights reserved.

19

Zscaler and Slack Deployment Guide

Configure Slack to use the Identity Proxy
1. Log into the Slack tenant with administrator credentials.
2. From your Organization Settings, select Security.
3. Select SSO Settings.
4. Select Configure SSO. The Slack SSO Configuration wizard is displayed.

Figure 9. Configure Slack for the identity proxy©2024 Zscaler, Inc. All rights reserved.

20

Zscaler and Slack Deployment Guide

Configure Slack Single Sign-On
In the Configure SSO wizard:
1. Paste the Zscaler Identity Proxy URL into the SAML 2.0 Endpoint URL field.
2. Paste the Zscaler Issuer Entity ID into the Identity Provider Issuer URL field.
3. Set the Service Provider Issuer URL to https://slack.com.
4. Open the zscaler_certificate.cer file with a text editor, and copy and paste the entire contents into the Public (X.509)
Certificate field.
5. Deselect the Sign the Response checkbox.
6. Click Test Configuration.

Figure 10. Slack SSO wizard confirmation

Clipboard-list The certificate must be one continuous string with no line feeds or carriage returns.

©2024 Zscaler, Inc. All rights reserved.

21

Zscaler and Slack Deployment Guide

Configure Slack Single Sign-On
If the configuration tests correctly, a confirmation is displayed (Everything looks good!). If there is a problem with theconfiguration, a Glitch Reported or a failure response is displayed. You must repeat the process from the beginning.
Click Confirm Update to activate the configuration.

Figure 11. Slack SSO wizard confirmation©2024 Zscaler, Inc. All rights reserved.

22

Zscaler and Slack Deployment Guide

The Completed Slack Configuration
The completed SSO configuration looks similar to the following image.

Figure 12. The completed identity provider configuration©2024 Zscaler, Inc. All rights reserved.

23

Zscaler and Slack Deployment Guide

User Informational Email
Users receive an email stating they need to use their Single Sign-On credentials.

Figure 13. Email informing users©2024 Zscaler, Inc. All rights reserved.

24

Zscaler and Slack Deployment Guide

The Zscaler Active Identity Proxy Notification
This is the notification a Slack user receives if they are trying to log into Slack without going through Zscaler. When youruser traffic goes through Zscaler, they can access Slack as usual.

Figure 14. The active authentication proxy©2024 Zscaler, Inc. All rights reserved.

25

Zscaler and Slack Deployment Guide

Configuring Tenancy Restrictions for Slack
The ZIA security cloud is a fully integrated cloud-based security stack that sits in line between users and the internet,
inspecting all traffic (including SSL) flows between them. As part of the platform, Zscaler Cloud Application Visibility &Control delivers full visibility into application usage, and granular policies ensure the proper use of both sanctioned andunsanctioned applications. While SaaS Tenant Security is out-of-band for data-at-rest, Zscaler Cloud Application security
is inline.
Cloud App Control provides SaaS application intelligence to consolidate all associated URLs and functions of theapplication in a single security setting. This allows you to control specific access, tenant, user, groups, locations, ordepartments, and only allow the required users to the application and the correct tenant within Slack.

Figure 15. ZIA tenancy restrictions in use with Slack

Zscaler’s tenancy restrictions feature allows you to restrict access either to personal accounts, business accounts, or bothfor Slack. It consists of two parts: creating a tenant profile and associating it with Cloud App Control policy rules.

©2024 Zscaler, Inc. All rights reserved.

26

Zscaler and Slack Deployment Guide

Create a Tenant Profile
To create the tenant profile to allow specific users:
1. Sign into your organization’s ZIA Admin Portal with admin credentials.
2. Go to Administration > Tenant Profiles.
3. Select Add Tenant Profile. This launches the Add Tenant Profile wizard to create the profile.
4. Select Slack as the Cloud Application.
5. Provide a Name for the Tenant Profile.
6. Provide an org ID or workspace ID for the Workspace ID.
7. Add the Allowed Tenants by org ID or workspace ID.
8. Click Save.

Figure 16. Add tenant profile©2024 Zscaler, Inc. All rights reserved.

27

Zscaler and Slack Deployment Guide

Cloud Application Control Policy Wizard
Follow these steps to create a Cloud Application Control policy that allows users to the specific tenant:
1. Go to Policy > URL & Cloud App Control > Cloud App Control Policy.
2. Select Add and from the drop-down menu, select Collaboration & Online Meetings.
3. Set the Rule Order to ensure execution of the policy.
4. Select Slack for the Cloud Application.
5. Select Allow for Application Access.
6. Select Slack as the Tenant Profile you just created.
7. Click Save.

Figure 17. Create a Cloud App Control allow policy

Clipboard-list SSL Inspection is required for the feature to work. Make sure Slack traffic is getting inspected.

©2024 Zscaler, Inc. All rights reserved.

28

Zscaler and Slack Deployment Guide

Completed Tenant Restrictions
You can see the completed access policies. Activate the policy additions.

Figure 18. Completed Cloud Application Control Policy with the tenant profile©2024 Zscaler, Inc. All rights reserved.

29

Zscaler and Slack Deployment Guide

Tenant Restriction Alerts
Users who try to access the Slack application through either a browser or the application who do not have permission
receive an alert and the event is logged.

Figure 19. Alerts when accessing blocked Slack tenants©2024 Zscaler, Inc. All rights reserved.

30

Zscaler and Slack Deployment Guide

Configuring the Slack Tenant
You must configure the Slack tenant to allow authenticated API calls to be made between the Zscaler and Slack cloud
platforms. Adding the tenant is a requirement to enable the Zscaler SaaS Security API services, DLP, and malware
protection.
To start the configuration process, log into your ZIA Admin Portal with admin credentials. Your Zscaler cloud instancemight be different from the example. The current ZIA clouds include: zscaler.net, zscalerone.net, zscalertwo.net,
zscalerthree.net, zscloud.net, zscalerbeta.net, and zscalergov.net.

Figure 20. ZIA Admin Portal©2024 Zscaler, Inc. All rights reserved.

31

Zscaler and Slack Deployment Guide

Adding the Slack Tenant
To launch the SaaS Application Tenants wizard for the ZIA Admin Portal:
1. Go to Administration > SaaS Application Tenants.
2. On the SaaS Applications Tenants page, select Add SaaS Application Tenant.

Figure 21. ZIA SaaS Application Tenant©2024 Zscaler, Inc. All rights reserved.

32

Zscaler and Slack Deployment Guide

SaaS Tenant Configuration Wizard
To start the wizard:
1. Select Add SaaS Application Tenant on the Tenant page.
2. Click the Slack tile.

Figure 22. The SaaS Tenant Configuration wizard©2024 Zscaler, Inc. All rights reserved.

33

Zscaler and Slack Deployment Guide

SaaS Tenant Configuration Wizard
Give the Slack tenant a name. This is the name used when assigning a policy for the Zscaler security features:
1. Enter the Tenant Name.
2. Enter the Slack Admin Email ID.
3. Right-click the Provide Admin Credentials link, and open the link in a new tab.
4. Open a new browser tab and login to your Slack tenant with admin role credentials.

Figure 23. Open the Slack tenant©2024 Zscaler, Inc. All rights reserved.

34

Zscaler and Slack Deployment Guide

Configuring the Zscaler Tenant on SlackTo configure the Zscaler tenant from your Slack admin account:
1. Log in to Slack with admin credentials.
2. Click Allow to enable communication between the cloud platforms. You must approve the Zscaler application on
Slack.

Figure 24. Allow Zscaler access to the Slack tenant©2024 Zscaler, Inc. All rights reserved.

35

Zscaler and Slack Deployment Guide

Configuring the Zscaler Tenant on SlackTo approve the Zscaler application to allow API calls to be made from Zscaler to Slack:
1. As an admin, select Manage Organization.
2. Under Organization, select Apps.
3. Select Approve for the Zscaler Application.
4. After the Zscaler application is approved, return to the ZIA Admin Portal and execute the next step of theinstallation.

Figure 25. Approve the Zscaler application

In the Zscaler Tenant setup, select the Provide Admin Credentials link on Step 5, next. After you haveprovided the admin credentials, the tenant configuration is complete.

©2024 Zscaler, Inc. All rights reserved.

36

Zscaler and Slack Deployment Guide

5. Right-click the Provide Admin Credentials link and open the link in a new tab.
6. Save and Activate the configuration. This completes the creation of the Slack tenant. You can now apply Zscaler
SaaS Security API controls on the Slack instance using Zscaler data and malware protection.

Figure 26. Authorize access to the Slack bot©2024 Zscaler, Inc. All rights reserved.

37

Zscaler and Slack Deployment Guide

The Active Slack Tenant
Check that the Status of Slack tenant is Active.
Go to Administration > SaaS Application Tenants.

Figure 27. Tenant status©2024 Zscaler, Inc. All rights reserved.

38

Zscaler and Slack Deployment Guide

Configuring Slack Policies and Scan Configuration
After adding and configuring the Slack tenant, you can configure the SaaS Security API Control, DLP,and malware policies,
and the Scan Configuration for the policies. You can also view reports and data for Slack in Analytics, SaaS Security
Insights, and Logs.

Figure 28. Zscaler policy configuration©2024 Zscaler, Inc. All rights reserved.

39

Zscaler and Slack Deployment Guide

Scoping the Policies and Remediation
Zscaler SaaS security scans Slack file attachments. This deployment guide configures a basic DLP policy and a malware
policy to scan the Slack account attachment files for matching content of the DLP policy, and to scan the files for known
malware using the malware policy. A Slack incident is created with malicious attachments and DLP violations to test thepolicies.
Zscaler SaaS security out-of-band data protection capabilities look inside the SaaS applications themselves throughAPI integrations to identify accidental, intentional data exposure, and compliance violations that would otherwise go
unnoticed.

Figure 29. Slack incident with malicious attachments

The DLP policy creates a spreadsheet with a list of US Social Security Numbers. DLP is a subject of its own, and this policy
is only used only for demonstration purposes. A true DLP policy review would need to be conducted to minimize false
positives and false negatives.
It is also important to note that the SaaS DLP protection is only part of the Zscaler DLP solution, and is used to scan data
at rest like the Slack files. This deployment doesn’t cover inline data protection, exact data match, or indexed document
matching (document template finger printing), although they are integral pieces of a complete data protection solution.
For next steps to test the DLP SaaS functionality, you create a basic policy and apply it to the Slack tenant. If you alreadyhave DLP policies created, skip ahead to Configure a SaaS Malware Policy.

©2024 Zscaler, Inc. All rights reserved.

40

Zscaler and Slack Deployment Guide

Creating a DLP Policy
The procedures for creating a DLP policy are straightforward. Create a custom dictionary, or use the available dictionaries,
to identify the data for which the scan looks. Then create an engine that is the logical template for adding expressions andadditional data. This is where you would specify Social Security Numbers and any other criteria for the policy. The engine
provides the means to precisely add or remove data to match the violation and eliminate false positives.
Next, create a SaaS security DLP policy that allows you to specify the detail about where, when, what action to take, andwhom to inform about violations. Finally, the DLP policy is applied to the Slack tenant.
Verify the DLP dictionary as next steps in the ZIA Admin Portal:
1. Go to Administration > DLP Dictionaries & Engines.
2. Select DLP Dictionaries.
3. Identify and select the dictionary to be used (in this case, SSN with Dashes), then verify the data search parameters.

Figure 30. Creating a DLP dictionary©2024 Zscaler, Inc. All rights reserved.

41

Zscaler and Slack Deployment Guide

Creating a DLP Engine
To create the DLP engine using the verified DLP dictionary:
1. Go to Administration > DLP Dictionaries & Engines.
2. Select the DLP Engines tab.
3. Select Add DLP Engine.

Figure 31. Creating a DLP engine©2024 Zscaler, Inc. All rights reserved.

42

Zscaler and Slack Deployment Guide

Creating a DLP Engine
1. Give the DLP engine a Name.
2. Select the verified dictionary in the Expression section under Engine Builder.
3. Specify the Match Count, which is the minimum number of instances the data can occur in the file before a match ismade. In this case, the fourth unique SSN number triggers a match.
4. (Optional) Select Add to add the next dictionary and repeat the process if desired.
5. Click Save.
6. Activate the configuration.

Figure 32. The DLP engine wizard

policy triggers when you see the fourth Social Security Number. Again, this is a demonstration and the
Clipboard-list This
criteria is too general to be a production DLP rule.

©2024 Zscaler, Inc. All rights reserved.

43

Zscaler and Slack Deployment Guide

Configure a SaaS DLP Policy
Apply the engine to a DLP policy that is used for the Slack instance. Launch the DLP Rule Wizard to start the process.
1. Go to Policy > SaaS Security API Control > Data Loss Prevention.
2. Select Collaboration.
3. Select Add DLP Rule. This launches the Add DLP Rule wizard for detailed configuration.

Figure 33. Launch the SaaS DLP Policy Configuration wizard©2024 Zscaler, Inc. All rights reserved.

44

Zscaler and Slack Deployment Guide

SaaS DLP Policy Details
The SaaS DLP specifies the details on whom and what data this policy applies. You specify the rule order if you havemultiple DLP policies that are processed in an ascending manner. The first rule that matches is the applied rule. Specify
the DLP engine you defined, any file owners, groups or departments, and the file types to inspect. The Content Locationand the Action are unique to the SaaS DLP and are explained next for clarification.
Content Location is the location type for the content in Slack that the Zscaler service inspects for sensitive data. Choose
Any to inspect all content locations or choose one of the Messages or Channels:•

Direct Messages•

Group Direct Messages•

Private Channels•

Public Channels•

Shared Channels

The Action the rule takes upon detecting content that matches the criteria. The number of actions available depends on
the selected SaaS Application tenant. For Slack, the action is Report Only. This means that any violations are reported in
the Zscaler SaaS Analytics and Alerts.
Report Incident Only: The rule reports the incident only and makes no changes to the file’s collaboration scope..

©2024 Zscaler, Inc. All rights reserved.

45

Zscaler and Slack Deployment Guide

Configure a SaaS DLP Policy
To finish the DLP policy:
1. Specify the Rule Order for processing (the first rule matched is executed).
2. Name the rule.
3. Enable the Rule Status.
4. Select Slack as the SaaS Application Tenant.
5. Select the DLP Engine created in Creating a DLP Policy.
6. Select Any for the Content Location.
7. Select Report Incident Only as the Action.
8. Select High as a Severity to allow for identification for searches and tracking.
9. Click Save and Activate your configuration.

Figure 34. The SaaS DLP Policy configuration wizard©2024 Zscaler, Inc. All rights reserved.

46

Zscaler and Slack Deployment Guide

The completed DLP rule is ready to be applied with a scanning schedule.

Figure 35. The configured DLP policy©2024 Zscaler, Inc. All rights reserved.

47

Zscaler and Slack Deployment Guide

Configure a SaaS Malware Policy
To launch the Malware Rule wizard:
1. Go to Policy > SaaS Security API Control > Malware Detection.
2. Select Collaboration.
3. Select Add Malware Detection Rule.
The SaaS Malware Detection policy is an all-encompassing policy. All files in the tenant are scanned unless removed
from the scope by specifying any exemptions using the Exemption tab under Malware Detection. To add a malware
policy, specify the application, the SaaS tenant, and the status.
4. The Action for Slack is limited to Report Malware only.

Figure 36. Launch the Malware Policy configuration wizard©2024 Zscaler, Inc. All rights reserved.

48

Zscaler and Slack Deployment Guide

SaaS Malware Detection Policy Wizard
Configure the Malware Rule wizard:
1. Go to Policy > SaaS Security API Control > Malware Detection.
2. Select Collaboration.
3. Select Add Malware Detection Rule.
4. Under Criteria, select Slack as the Application.
5. Select the Slack Application Tenant to apply the policy.
6. Select Enabled for Status.
7. Select Report Malware as the Action.
8. Click Save.

Figure 37. The Malware Detection Policy configuration wizard©2024 Zscaler, Inc. All rights reserved.

49

Zscaler and Slack Deployment Guide

SaaS Malware Detection Policy
Apply the completed SaaS Security Malware Detection policy for the Slack SaaS tenant to the Slack instance with ascanning schedule.
Activate your configuration.

Figure 38. The completed Malware Detection policy configuration wizard©2024 Zscaler, Inc. All rights reserved.

50

Zscaler and Slack Deployment Guide

Configure the Scan Schedule Configuration
The final configuration step is to create a scan configuration. Specify the tenant the scan configuration applies to, any
policies that are to be included in the scan, and what data to scan relative to a date. The options for Data to Scan are All
Data, Date Created or Modified After, or New Data Only. This deployment guide selects All Data. However, if this is a POV
or a Trial, the only option available is New Data Only.
To add a scan schedule:
1. Go to Policy > SaaS Security API Control > Scan Configuration > Add Scan Schedule.
2. Select the Slack SaaS Tenant for the SaaS Application Tenant.
3. Select the data loss policy and the malware policy created in prior steps.
4. Select All Data.
5. Click Save to save the scan schedule and activate the configuration.

Figure 39. Create and enable a scan for the SaaS tenant

Clipboard-list For a POV or Trial, select New Data Only.

©2024 Zscaler, Inc. All rights reserved.

51

Zscaler and Slack Deployment Guide

Start the Scan Schedule
After the schedule is configured and saved, start the scan for the DLP policy and malware policy to be applied.
1. Click the Start icon.
2. Review the Status column and ensure it is Running with a start date and a latest scan date.

Figure 40. Starting the scan

©2024 Zscaler, Inc. All rights reserved.

52

Zscaler and Slack Deployment Guide

Reporting and Visibility
Zscaler Analytics provide detailed reporting of all user activity down to each session created by the user when visiting
a destination. Zscaler extends that visibility to include reporting of activity, malware incidents, and DLP violations fordata-at-rest associated with the user. Zscaler provides reports and SaaS security insights for the SaaS partners. This gives
visibility from a high-level and lets you manage individual logs and violations.
Take a brief look at the tools, but for detailed information of the SaaS Security Analytics tools, see SaaS Security Alerts &Activities Report (government agencies, see SaaS Security Alerts & Activities Report).

Figure 41. SaaS security visibility©2024 Zscaler, Inc. All rights reserved.

53

Zscaler and Slack Deployment Guide

SaaS Assets and SaaS Assets Summary Report
The SaaS asset reports provide a summary or customizable reporting to provide a quick view of your files and emails. The
SaaS Assets Summary Report provides all activity and violations in a quick glance. The report identifies all SaaS tenant
information from a single screen.
The Slack activity over the creation of this deployment guide is shown, but any tenant configured is also displayed on thissummary screen. The data is hyperlinked, and you can pivot from a summary to individual logs and activities provided by
SaaS security insights.
1. Select the Total incidents number next to the Slack application to pivot to SaaS security insights.
2. On the Security Logs window, review the log data for each incident containing over 30 metadata points of
information.

Figure 42. Summary reports©2024 Zscaler, Inc. All rights reserved.

54

Zscaler and Slack Deployment Guide

SaaS Security Insights
The SaaS Security Insights page is where you can view and select information fields that you want to view when analyzing
files scanned through charts. These logs provide the detail of the policy that found the violation, the threat name, theowner and over 30 metadata points for identification and threat hunting.
The following are the SaaS Security data types and their associated filters:•

Application•

Application Category•

Department•

DLP Dictionary•

DLP Engine•

Incident Type•

Owner Name•

Severity•

Tenant•Threat Category•

Threat Super Category

•

User

Figure 43. SaaS security insight©2024 Zscaler, Inc. All rights reserved.

55

Zscaler and Slack Deployment Guide

Zscaler Digital Exchange (ZDX) for SlackZDX is the missing link needed for customers and their SaaS applications. As applications move to the cloud, the internet
is your new transport network. With users working from anywhere, IT teams struggle to monitor and isolate issues
affecting the user-to-cloud app experience. ZDX provides visibility into the client’s experience using Slack. ZDX uses theZscaler Client Connector to generate application and network probes and gather device health. ZDX is a separate service
from ZIA SaaS Security and can run with or without SaaS Security enabled.

Figure 44. ZDX for user experience monitoring for SlackZDX allows organizations to continuously gather and analyze data on end-user device resources and events, such as CPU,
memory usage, and Wi-Fi connectivity issues that impact end-user experiences. Measure and analyze end-to-end andhop-by-hop network path metrics from every user device to the cloud application. With cloud path visibility, you canproactively detect and resolve end-user connectivity issues to cloud applications.
Continuously monitor and measure application metrics, such as response time, DNS resolution, and broader availability
metrics of the application. Monitor aggregated user experience performance scores tracked over time at the user,
application, location, department, and organizational level.

©2024 Zscaler, Inc. All rights reserved.

56

Zscaler and Slack Deployment Guide

Log in to ZDX
Log into the ZDX Admin Portal with admin credentials to begin the configuration process.

Figure 45. ZDX for user experience monitoring for Slack©2024 Zscaler, Inc. All rights reserved.

57

Zscaler and Slack Deployment Guide

Configure ZDX for Slack
Although Slack is not a predefined application in ZDX, you can configure it. To configure the Slack application formonitoring, configure Slack as an application and add a Web probe and a network probe:
1. Select Configuration.
2. Select Applications.
3. Select Add New Custom Application. The New App wizard is displayed for you to enter a name and to enable the
Slack application.

Figure 46. Onboard the Slack app©2024 Zscaler, Inc. All rights reserved.

58

Zscaler and Slack Deployment Guide

4. To configure the Slack application for monitoring, add a Name for the Slack application.
5. Select Enable for Status.
6. Click Save.

Figure 47. Onboard the Slack app

This defines the application. Create the Web probe and the Cloud Path probe for monitoring the application.

©2024 Zscaler, Inc. All rights reserved.

59

Zscaler and Slack Deployment Guide

Configure ZDX Probes for Slack
Slack is defined as an application in ZDX. You must configure the probes. Select Add New Probe under the Slackapplication you just created.
This launches the Probe wizard to create the probes for monitoring the Slack application.

Figure 48. Onboard the Slack app©2024 Zscaler, Inc. All rights reserved.

60

Zscaler and Slack Deployment Guide

For the Web probe:
1. Give the Web probe a logical Name.
2. Select Enable for Status.
3. Select Slack as the Application.
4. Select Web as a Probe Type.
5. Enter 5 minutes as the Run Frequency.
6. Click Next.

Figure 49. Configure the Slack probes©2024 Zscaler, Inc. All rights reserved.

61

Zscaler and Slack Deployment Guide

7. Enter the Slack Instance URL for the Destination URL.
8. Click Next.

Figure 50. Configuring the Web probe©2024 Zscaler, Inc. All rights reserved.

62

Zscaler and Slack Deployment Guide

Verify the Web probe configuration and make any changes necessary and then submit the probe configuration. Click
Submit.

Figure 51. Configuring the Web probe©2024 Zscaler, Inc. All rights reserved.

63

Zscaler and Slack Deployment Guide

The completed Web probe is displayed. Click Add New Probe. This displays the Probe Configuration wizard to create the
Cloud Path probe to monitor the network.

Figure 52. The completed Web probe©2024 Zscaler, Inc. All rights reserved.

64

Zscaler and Slack Deployment Guide

Configure Probes for Slack Monitoring
To enable monitoring for the new probe:
1. Enter a Name for the probe.
2. Verify the probe is Enabled.
3. Select Cloud Path as the Probe Type.
4. For Follow Web Probe, select Slack.
5. Click Next to move to the probe detail.

Figure 53. Create the Cloud Path probe©2024 Zscaler, Inc. All rights reserved.

65

Zscaler and Slack Deployment Guide

6. To enable Slack monitoring for the probe, select ICMP as the Protocol.
7. Enter the Slack Instance URL for your organization in the Cloud Path Host field.
8. Click Next to review the probe configuration.

Figure 54. Create the Cloud Path probe©2024 Zscaler, Inc. All rights reserved.

66

Zscaler and Slack Deployment Guide

Configure ZDX Probes for Slack
Review the probe configuration and then click Submit to activate your probe.

Figure 55. The completed Cloud Path probe©2024 Zscaler, Inc. All rights reserved.

67

Zscaler and Slack Deployment Guide

The completed Slack probes are displayed. Activate the changes to enable the probes.

Figure 56. ZDX probes monitoring for Slack©2024 Zscaler, Inc. All rights reserved.

68

Zscaler and Slack Deployment Guide

The ZDX-Enabled Slack Application
The Slack application monitoring is activated and the probes begin monitoring users using the Zscaler Client Connector.
The figure shows the Zscaler Client Connector running the ZDX and the cloud service is enabled and active.

Figure 57. Active Slack monitoring©2024 Zscaler, Inc. All rights reserved.

69

Zscaler and Slack Deployment Guide

Create an Alert for the Slack Service
As a final configuration step, create an alert to email when there is service degradation of the Slack application. You cancreate an alert for network, application, or device thresholds. Create an alert rule with any of the following information:•

Network Probe. Latency, MTR, Packet Loss, Number of Hops•

Application Probe. DNS Response Time, Page Fetch Time, Server Response Time, Web Request Availability•

Device Monitor. CPU Usage, Bandwidth, Battery, CPU, Disk, Wi-Fi Signal Strength, Memory, Sent and Received Mbps

To create the alert on page fetch times:
1. Select Alerts.
2. Select Rules.
3. Select Add New Alert Rule.

Figure 58. Creating an alert©2024 Zscaler, Inc. All rights reserved.

70

Zscaler and Slack Deployment Guide

Create an Alert for the Slack Service
Step one of the Add New Alert Rule wizard:
1. Name the Rule.
2. Select Enable under Status.
3. Give the alert an appropriate Severity.
4. Select Application under Type.
5. Click Next.

Figure 59. The alert creation wizard, step one©2024 Zscaler, Inc. All rights reserved.

71

Zscaler and Slack Deployment Guide

6. Select Slack as the Application.
7. Select Slack as the Web Probe.
8. Click Next.

Figure 60. The alert creation wizard, step two©2024 Zscaler, Inc. All rights reserved.

72

Zscaler and Slack Deployment Guide

9. Step three of the Add New Alert Rule wizard creates the threshold that is triggered the if exceeded. Use multiple
variables to eliminate a false positive:
a. Select Page Fetch Time.
b. Select the time to exceed 5000ms (5 seconds).
c. Click Next.

Figure 61. The alert creation wizard, step three©2024 Zscaler, Inc. All rights reserved.

73

Zscaler and Slack Deployment Guide

10. Step four of the Add New Alert Rule wizard adds throttling to control the scope of the alert, and defines the action.
You can define the action as an authenticated webhook to send the alert to a Slack channel:
a. Enter 10 for the number of times the probe time must exceed the threshold.
b. Enter 10 and select Percentage for the Minimum Devices Impacted.
c. Select Email as the Delivery Method.
d. Enter the Alert Recipients email address (or multiple addresses separated by commas).

Figure 62. The alert creation wizard, step four

©2024 Zscaler, Inc. All rights reserved.

74

Zscaler and Slack Deployment Guide

The completed rule set for the alert is displayed. Activate the configuration.

Figure 63. The completed alert rule set©2024 Zscaler, Inc. All rights reserved.

75

Zscaler and Slack Deployment Guide

The Triggered Alert for the Slack Service
The Alerts tab shows the triggered alert generated by the exceeded threshold settings in the rule set. You can click theRule Name or click the View icon to see more detail about the alert.
1. Select Alerts.
2. Select the Rule Name.

Figure 64. The alert©2024 Zscaler, Inc. All rights reserved.

76

Zscaler and Slack Deployment Guide

Alert Detail for the Slack Service
The Alerts window displays the alert detail for the triggered Slack alert showing impacted user and devices, impact
location, and threshold details.

Figure 65. Alert details©2024 Zscaler, Inc. All rights reserved.

77

Zscaler and Slack Deployment Guide

The Sent Alert Email for the Slack Service
The following is an example of the email alert that was sent to the recipients after the threshold was exceeded. Anotheremail is sent when the threshold returns to normal values if the alert was an ongoing or continuous alert.

Figure 66. The alert email©2024 Zscaler, Inc. All rights reserved.

78

Zscaler and Slack Deployment Guide

Using the ZDX Dashboard
The ZDX dashboard provides a single page to monitor the user experience (ZDX Score) of all users and all applications. An
active heat map also shows you any locations globally that might have issues.

Figure 67. The ZDX Dashboard©2024 Zscaler, Inc. All rights reserved.

79

Zscaler and Slack Deployment Guide

Application Overview and Performance Detail
Selecting Application on the left-side navigation of the ZDX Admin Portal displays the Applications Overview, whichshows all the configured applications and the individual ZDX Score.
1. Select Applications.
2. Select the Slack application.

Figure 68. Application overview©2024 Zscaler, Inc. All rights reserved.

80

Zscaler and Slack Deployment Guide

Slack Application Performance Detail
The top portion of the application detail shows a historical view of the ZDX Score Over Time and the Page Fetch Time.
The failure of the page fetch time indicates a service loss of the Slack service itself.

Figure 69. Application performance detail©2024 Zscaler, Inc. All rights reserved.

81

Zscaler and Slack Deployment Guide

The bottom portion of the application detail shows the Top Departments, Top Regions, and Top Zscaler Locations using
the application and the ZDX scores at a glance. You also see probe data, with minimum, average, and maximum response
times.

Figure 70. Application performance detail©2024 Zscaler, Inc. All rights reserved.

82

Zscaler and Slack Deployment Guide

User Overview and Detail
The User Overview provides all the users of an application. Select Slack and then Apply to see all Slack users. The ZDXscore is provided, and you can select users by Poor, Okay, or a Good ZDX Score. You can get more detail on the user byclicking the name or the View icon on the right. Select a User to display more detail.
1. Select Users.
2. Select the Slack application.
3. Click Apply.

Figure 71. User overview©2024 Zscaler, Inc. All rights reserved.

83

Zscaler and Slack Deployment Guide

Slack User Detail
The User Detail shows data to help isolate any user experience issues. Select and apply the Slack application to see thedetail of the user experience for the Slack app. This report displays the user’s devices and provides the device-specificdetail (OS, Device Type, Network Information, etc.) by clicking the device. From this page, you can see the ZDX Score in atimeline, and details of Page Fetch Times, Server Response, DNS Response, Probe Detail, and Device Health.
Select the User Device.

Figure 72. User detail©2024 Zscaler, Inc. All rights reserved.

84

Zscaler and Slack Deployment Guide

User DetailIf there is any issue from the users’ device health, the network at the home office, any Service Provider in the path, or anissue with Zscaler, or Slack itself, ZDX provides the visibility of the cloud to the Zscaler administrators from any of theirusers’ individual environments.

Figure 73. User detail, end-to-end connection detail©2024 Zscaler, Inc. All rights reserved.

85

Zscaler and Slack Deployment Guide

Zscaler Posture Control (ChatOps) and SlackYou can integrate Zscaler Posture Control (ZPC) with Slack, a tool for centralized communication and collaboration. ZPC
detects various security issues in your public cloud infrastructure and misconfigurations in the CI/CD pipeline. Theseissues are sent as alert notifications on Slack so you can investigate and address the issues on a common platform andstreamline the mitigation directly into your developer tool.

Prerequisites
Before integrating ZPC with Slack, you must set up a Slack webhook endpoint.
1. Login to the Slack administrator portal.
2. Select Configure Apps.
3. In the Slack app directory select Build.

Figure 74. Slack app directory©2024 Zscaler, Inc. All rights reserved.

86

Zscaler and Slack Deployment Guide

4. Click Create an App.

Figure 75. Create custom app

5. Select From scratch.

Figure 76. Create an app©2024 Zscaler, Inc. All rights reserved.

87

Zscaler and Slack Deployment Guide

6. In the Name app & choose workspace window:
a. App Name: Enter a name for the app.
b. Pick a workspace to develop your app in: Select the Slack workspace from the drop-down menu.

Figure 77. Name app & choose workspace©2024 Zscaler, Inc. All rights reserved.

88

Zscaler and Slack Deployment Guide

7. Click Create App.
8. On the Basic Information page, select Incoming Webhooks.

Figure 78. Incoming webhooks©2024 Zscaler, Inc. All rights reserved.

89

Zscaler and Slack Deployment Guide

9. On the Incoming Webhooks page:a. Enable Activate Incoming Webhooks.
b. Click Add New Webhook to Workspace.

Figure 79. Activate incoming webhooks©2024 Zscaler, Inc. All rights reserved.

90

Zscaler and Slack Deployment Guide

10. Select the Slack channel to which ZPC must send notifications, then click Allow.

Figure 80. Allow Slack channel

11. Copy the Webhook URL. You must specify this URL when integrating ZPC with Slack.

Figure 81. Copy Webhook URL

Clipboard-list You can add only one Webhook per Slack channel.

©2024 Zscaler, Inc. All rights reserved.

91

Zscaler and Slack Deployment Guide

Integrating ZPC and SlackTo integrate ZPC with Slack:
1. From the ZPC Admin Portal, go to Administration > Integrations.
2. To the right of ChatOps (Slack), click Add.

Figure 82. Add ChatOps Slack integration

3. On the Integration Details page:a. Integration Name: Enter a unique name for the integration.
b. Channel Name: Enter the name of the Slack channel where you want to receive alert notifications.
c. Webhook URL: Enter the webhook URL that you copied from the Slack portal. The URL allows ZPC to connect
and communicate with the Slack channel.
d. Add More: (Optional) Click to include additional channels where you want to receive alert notifications.

Clipboard-list ZPC allows you to add ten channels per integration. You can configure another integration to add more channels.

©2024 Zscaler, Inc. All rights reserved.

92

Zscaler and Slack Deployment Guide

4. Click Test Connection to validate the Slack connection. A confirmation message appears that the Slack connection isverified. If not, then check the previous steps and try again.
5. Review the integration details on the Summary page.

Figure 83. Test ChatOps channel connection

6. Click Next and then Finish.

Figure 84. ChatOps configuration summary©2024 Zscaler, Inc. All rights reserved.

93

Zscaler and Slack Deployment Guide

The Slack integration is completed and the details are displayed on the Integrations page.

Figure 85. ChatOps completed integration

Create Notification Rules
ZPC can send notifications to Slack ChatOps based on alerts generated due to security and compliance violations incloud workloads and IaC.
On the ZPC Admin Portal page:
1. Click Alerts.
2. Select Notifications.
3. Click Create Rule.

Figure 86. Notifications©2024 Zscaler, Inc. All rights reserved.

94

Zscaler and Slack Deployment Guide

Create a Cloud Notification Rule
To create a cloud notification rule:
1. Enter an Alert Rule Name to the notification rule.
2. Select Cloud in Alert Type.
3. Select Alert Rule Status.
4. Click Next.

Figure 87. Add Alert Rule

5. In the Scope page, select the scope for that you want to receive notifications.
6. In the Select Policy section, select the policies to which you want alerts sent to Slack.
7. Click Next.

Figure 88. Add Alert Rule Scope©2024 Zscaler, Inc. All rights reserved.

95

Zscaler and Slack Deployment Guide

8. In the Notifications page, select Slack in the ChatOps section.
9. Select the name of the configured integration.
10. In Channel Name, select the channel where notifications should be posted.

Figure 89. ChatOps Notification Alert

11. Click Next.

©2024 Zscaler, Inc. All rights reserved.

96

Zscaler and Slack Deployment Guide

Analyzing ZPC Alerts in SlackTo visualize a ZPC alert in Slack, open the Slack channel configured in the ChatOps integration.

Figure 90. Slack Channel ZPC Alert©2024 Zscaler, Inc. All rights reserved.

97

Zscaler and Slack Deployment Guide

Appendix A: Requesting Zscaler Support
If you need Zscaler Support to provision certain services or to help troubleshoot configuration and service issues, it isavailable 24/7/365.

Requesting Help via ZIA
To contact Zscaler Support:
1. Go to Administration > Settings > Company Profile.

Figure 91. Collecting details to open support case with Zscaler TAC

2. Copy your Company ID.

Figure 92. Company ID©2024 Zscaler, Inc. All rights reserved.

98

Zscaler and Slack Deployment Guide

3. With your company ID information, you can open a support ticket. Go to Dashboard > Support > Submit a Ticket.

Figure 93. Submit a ticket©2024 Zscaler, Inc. All rights reserved.

99

Zscaler and Slack Deployment Guide

Requesting Zscaler Support via ZPC
To contact Zscaler Support:
1. Go to the ZPC help and select Support from the left-side navigation.
2. Select Submit Ticket.

Figure 94. ZPC Help

3. In the Submit Ticket window, select Submit Ticket for Posture Control (ZPC).

Figure 95. ZPC Support©2024 Zscaler, Inc. All rights reserved. 100

Zscaler and Slack Deployment Guide

4. In the ZPC - Submit Ticket window, fill in the required fields.

Figure 96. Submit ZPC ticket

5. Select the reCAPCHA checkbox, and click Submit. A Zscaler Support representative contacts you via the submitted
contact information within 24 hours.

©2024 Zscaler, Inc. All rights reserved. 101