Issue

While trying to onboard Slack audit logs to Panther, you see the following error:

Something went wrong when authorizing Panther Log App. Try going back to Panther Log App and authorizing again. If problems persist, contact support for help. 
Error details
no_bot_scopes_requested

Resolution

To resolve this issue:

• Verify that you have not created a Slack Bot User for the app.

  • If you have created a Slack Bot, delete the app you created for Panther and follow Panther's Slack log onboarding documentation again. 

• Verify that the User Token Scopes have the correct required scopes to pull audit logs. And verify that there are no Bot Token Scopes.

• Your Scopes section should look like this:

Cause

This issue can occur if you created a Slack Bot User while setting up the integration with Panther. Note that although Slack's App settings page under "Org Level Apps" mentions that you need to enable Bot Scopes, this is not necessary to create an Audit Logs log source for Panther to read Audit Logs across your organization. The access to read Audit Logs can be applied to your whole org at the time of OAuth authorization.