Chapter 4. Integrating with Slack If you are using Slack, you can forward alerts from Red Hat Advanced Cluster Security for Kubernetes to Slack. The following steps represent a high-level workflow for integrating Red Hat Advanced Cluster Security for Kubernetes with Slack: Create a new Slack app, enable incoming webhooks, and get a webhook URL. Use the webhook URL to integrate Slack with Red Hat Advanced Cluster Security for Kubernetes. Identify policies for which you want to send notifications, and update the notification settings for those policies. 4.1. Configuring Slack Start by creating a new Slack app, and get the webhook URL. Prerequisites You need an administrator account or a user account with permissions to create webhooks. Procedure Create a new Slack app: Note If you want to use an existing Slack app, go to https://api.slack.com/apps and select an app. Go to https://api.slack.com/apps/new . Enter the App Name and choose a Development Slack Workspace to install your app. Click Create App . On the settings page, Basic Information section, select Incoming Webhooks (under Add features and functionality ). Turn on the Activate Incoming Webhooks toggle. Select Add New Webhook to Workspace . Choose a channel that the app will post to, and then select Authorize . The page refreshes and you are sent back to your app settings page. Copy the webhook URL located in the Webhook URLs for Your Workspace section. For more information, see the Slack documentation topic, Getting started with Incoming Webhooks . 4.1.1. Sending alerts to different Slack channels You can configure Red Hat Advanced Cluster Security for Kubernetes to send notifications to different Slack channels so that they directly go to the right team. Procedure After you configure incoming webhooks, add an annotation similar to the following in your deployment YAML file: example.com/slack-webhook: https://hooks.slack.com/services/T00000000/B00000000/XXXXXXXXXXXXXXXXXXXXXXXX Use the annotation key example.com/slack-webhook in the Label/Annotation Key For Slack Webhook field when you configure Red Hat Advanced Cluster Security for Kubernetes. After the configuration is complete, if a deployment has the annotation that you configured in the YAML file, Red Hat Advanced Cluster Security for Kubernetes sends the alert to the webhook URL you specified for that annotation. Otherwise, it sends the alert to the default webhook URL. 4.2. Configuring Red Hat Advanced Cluster Security for Kubernetes Create a new integration in Red Hat Advanced Cluster Security for Kubernetes by using the webhook URL. Procedure In the RHACS portal, go to Platform Configuration Integrations . Scroll down to the Notifier Integrations section and select Slack . Click New Integration ( add icon). Enter a name for Integration Name . Enter the generated webhook URL in the Default Slack Webhook field. Select Test to test that the integration with Slack is working. Select Create to generate the configuration. 4.3. Configuring policy notifications Enable alert notifications for system policies. Procedure In the RHACS portal, go to Platform Configuration Policy Management . Select one or more policies for which you want to send alerts. Under Bulk actions , select Enable notification . In the Enable notification window, select the Slack notifier. Note If you have not configured any other integrations, the system displays a message that no notifiers are configured. Click Enable . Note Red Hat Advanced Cluster Security for Kubernetes sends notifications on an opt-in basis. To receive notifications, you must first assign a notifier to the policy. Notifications are only sent once for a given alert. If you have assigned a notifier to a policy, you will not receive a notification unless a violation generates a new alert. Red Hat Advanced Cluster Security for Kubernetes creates a new alert for the following scenarios: A policy violation occurs for the first time in a deployment. A runtime-phase policy violation occurs in a deployment after you resolved the runtime alert for a policy in that deployment.

Commands:
example.com/slack-webhook: https://hooks.slack.com/services/T00000000/B00000000/XXXXXXXXXXXXXXXXXXXXXXXX