Slack Integration with DefectDojo

Slack Integration with DefectDojo

Slack is the messaging platform from Salesforce that many engineering and security teams use as their main channel for day-to-day communication. Slack apps can post into channels and direct messages through a bot token, which is how DefectDojo sends its messages. DefectDojo's Slack integration works in one direction: DefectDojo posts notifications and alerts about security events into Slack, and does not read anything back.

Slack Integration with DefectDojo

We connected Slack to DefectDojo because the people who need to act on security findings are already in Slack all day, and an email digest gets ignored. DefectDojo posts to a security channel when scans land and Engagements change, and individual engineers get their own messages when they are mentioned or when something on their Asset needs attention. With DefectDojo Pro, we went further: Messaging Connector alerts post only when an import brings in new High or Critical findings, so the channel stays quiet unless there is something worth reading.

Why Slack Matters

A finding that nobody sees doesn't get fixed, and most security events need a human to notice them quickly.

• Slack is where engineers already respond to incidents and reviews, so security messages there get read faster than mail.
• Channel posts give a whole team the same view of new activity without everyone logging into DefectDojo.
• Personal messages make mentions and review requests hard to miss.
• Without filtering, a busy DefectDojo instance can flood a channel. The way the integration is configured decides whether Slack helps or becomes noise.

Advantages of This Integration

What we gained by sending DefectDojo events to Slack:

• System-wide channel posts. A superuser points DefectDojo at one Slack channel and chooses which notification types go there, in Community Edition and DefectDojo Pro.
• Personal notifications. Each user can add their Slack email address and pick which events they receive, including per-Asset notifications for the Assets they watch.
• Rule-based alerts in DefectDojo Pro. Messaging Connectors route alerts through Triage Engine rules, so a message can be limited by severity, scope, tags, status, or anything else a rule condition can express.
• Batched messages. Imports are batched, so one import produces one alert instead of one message per Finding, unless you choose otherwise.
• Simulate before going live. Pro alerts can run in Simulate mode, recording what would have been sent without posting anything.
• Failure handling. A revoked Slack token disables the affected destination after a few consecutive credential failures, and DefectDojo reports which destination was disabled and why.

How This Integration Works

There are two ways to send DefectDojo messages to Slack. Both need a Slack app with a bot token.

Option 1: Notifications (Community Edition and DefectDojo Pro).

1. At https://api.slack.com/apps, create a new app From App Manifest, using the manifest in the DefectDojo docs. It requests the bot scopes chat:write, chat:write.customize, chat:write.public, incoming-webhook, users:read, and users:read.email. Install it to your workspace.
2. Copy the Bot User OAuth Token from OAuth & Permissions.
3. In DefectDojo, open System Settings (Configuration in the Classic UI, or Settings > System > System Settings in the Pro UI). Check Enable Slack notifications, paste the token, and enter the Slack Channel. Optionally change the bot name. You need Superuser access.
4. Choose which events go to Slack on the System Notifications page.
5. For personal messages, each user sets a Slack Email Address under Additional Contact Information on their profile, then selects Slack for the events they want on their Personal Notifications page.

Option 2: Messaging Connectors (DefectDojo Pro, beta). Enable Messaging Connectors on the Feature Flags page, along with Triage Engine, which routes the alerts.

1. Create a Slack app From scratch with the chat:write scope. Add chat:write.public if the app should post to public channels without being invited. Install it and copy the xoxb- bot token.
2. Under Connect > Downstream, find Slack in the Messaging section and select Add Configuration. Enter your workspace URL as Location, an Identifier, and the Bot Token. DefectDojo validates the token when you save.
3. Find the channel ID in Slack (channel name, then the bottom of the About tab). Destinations take a channel ID such as C0123456789, not a name. Without chat:write.public, invite the bot with /invite @your-app-name.
4. Use Send test message to confirm the bot can post there.
5. Create an alert from Messaging Alerts: choose New findings from an import, the Slack connection, the channel ID, a severity floor, and Simulate or Live mode. For anything more specific, build a Triage Engine rule with a Send a Slack Message node.

You can add several Slack connections, one per workspace you need to reach.

Data Granularity: What Gets Sent

System-wide Slack notifications are not filtered by RBAC, because the channel isn't tied to a DefectDojo user. Every selected system notification goes to that channel, so restrict who can join it.

Use Cases

A security team channel: System notifications for scans added and Engagements created post to a private security channel, giving the AppSec team a running log of activity without opening DefectDojo.

Developer mentions: Engineers add their Slack email to their DefectDojo profile, so a mention in a Finding note or a review request reaches them directly.

High-severity import alerts with DefectDojo Pro: A Messaging Connector alert posts to a team's channel only when an import into that team's Assets brings in new High or Critical findings. A Low-only import stays silent.

Connector health: In DefectDojo Pro, the Connector Health Warning notification can be routed to Slack, so a failing Upstream Connector is noticed when it breaks rather than weeks later.

Operational Tips

• Keep the system-wide channel private. It receives every selected system notification for every Organization, with no RBAC filtering.
• Use personal notifications, or Pro Messaging Connector rules scoped to specific Assets, when different teams should see different events.
• Start new Pro alerts in Simulate mode and review the recorded deliveries before switching to Live.
• Don't point a Messaging Connector alert at the same channel the system-wide notification already uses, or that channel receives both messages.
• Older Triage Engine Slack nodes no longer fall back to the System Settings token. Open each such rule, choose a connection and destination, and save it.
• After rotating the Slack bot token, send a test message to each destination. A successful test re-enables any destination that was disabled for credential failures.