Stop using legacy slack incoming webhooks

matthauck commented 2 years ago

Start to implement newer slack app interface

matthauck commented 2 years ago

did some local testing -- seems to work!

jmealins commented 2 years ago

is there a single token per bot? or per channel?

matthauck commented 2 years ago

is there a single token per bot? or per channel?

A single token per bot (slack workspace)

matthauck commented 2 years ago

I think worth adding:

It's a bummer that outlook did not flag the fact that this email did not have a valid dkim signature -- it was @tanium.com, but was not signed. gmail used to flag this i think.
It's a bummer that hovering over links shows "urldeffense.com/..." -- hard to know where the actual link is going. I wonder if this obfuscation is more harmful than helpful?

From: Tanium ServiceNow @.> Sent: Thursday, February 10, 2022 1:32 PM To: Matt Hauck @.> Subject: Incident INC0206371 -- comments added

Incident Number: INC0206371 Incident state: Resolved User: Matthew Hauck Severity: 3 - Low Comments:

2022-02-10 13:31:51 PST - svc_itsec_automation Additional comments Thank you for reporting this message to Tanium's internal security and IT teams. This email was a part of a phishing training campaign designed to help our users practice and improve their skills at spotting suspicious emails.

Great job on catching this phishing attempt and please continue to be diligent in handling and reporting suspicious emails.

Regards, Tanium Security

You can view all the details of the incident by following the link below:

Take me to the Incidenthttps://tanium.service-now.com/incident.do?sys_id=90b9ae121ba1c190a3ddea0dad4bcbe9&sysparm_stack=incident_list.do?sysparm_query=active=true

Thank you.

Ref:MSG3741234

tanium / octobot

Stop using legacy slack incoming webhooks #305