QUESTION

How do I tag Slack users with Slackbot Alerts from Panther?

ANSWER

To tag a Slack user using Panther's Slackbot, you can enter their member ID in either the alert_context function or the runbook field. It's essential to ensure that you're using the member ID format (<@U123456>) instead of the Slack username format (<@user>). When entering the member ID, make sure to enclose it within angle brackets (<>).

To find your Slack member ID:

1. Click your profile picture in the top right corner of Slack.

2. Click Profile.

3. Click the vertical 3-dots icon.

4. Click Copy member ID. 

Alternatively, you can tag a Slack team or subteam:

• To tag a Slack team, use this format: <@teamID>. For example, <@T012ABCDEFG>.

• To tag a Slack subteam, use this format: <!subteam^ID>. For example, <!subteam^S012ABCDEFG>.