Issue

When trying to authorize my new Slack App for onboarding logs to Panther, the following error occurs: team_not_authorized

Resolution

To resolve this issue:

1. If you're creating a Slack App for Slack.AuditLogs, ensure that you're on an Enterprise Grid Slack Plan.

2. When setting this up on the Slack side, ensure you are signed in as an owner of the Enterprise Grid organization.

3. Ensure you're installing your App on an Slack Enterprise Grid organization, not on a specific Slack Workspace.

Cause

This Slack error occurs when the app is installed on a Slack workspace but needs to be installed on an Enterprise Grid organization.

• Slack's documentation on managing apps on Enterprise Grid and building apps in Enterprise Grid.

The Audit Logs API is only available to Slack customers with an Enterprise Grid plan.

When creating a Slack App to pull logs, you must sign in as an owner of the organization.

Please see Panther's documentation on Slack Logs for information on requirements and instructions.