SETUP GUIDE

Connect Slack

Get Strix critical alerts in the Slack channel your team already lives in. Create an incoming webhook, paste it into Strix, and send a test — that's the whole setup.

~5 min One-way notifications Incoming webhook

How it works

Slack is a notification destination, not an alert source. The flow runs one way.

Strix → Slack

When a critical alert fires, Strix POSTs a message to your Slack incoming webhook, and it appears in the channel that webhook targets.

Critical alerts only

Only critical alerts notify — the same bar that auto-opens a case — so the channel stays a stream of things worth reacting to, not every event.

Set it up

Three steps from an empty channel to live alerts.

Before you start

  • A Slack workspace where you can create an app / incoming webhook.
  • Admin access in Strix (only admins can save the webhook).
  • The Slack channel that should receive critical alerts.
  1. 1
    Create a Slack incoming webhook

    In Slack, go to api.slack.com/apps → Create New App → From scratch, name it “Strix” and pick your workspace. Open Incoming Webhooks, toggle it On, then Add New Webhook to Workspace and choose the channel that should receive alerts. Slack generates a webhook URL — copy it.

    https://hooks.slack.com/services/T00000000/B00000000/XXXXXXXXXXXXXXXXXXXXXXXX
  2. 2
    Paste it into Strix

    In Strix, open Integrations → Slack → Configure. Paste the webhook URL into the Webhook URL field and Save. Only an admin can set this; other members see it as managed by an admin.

  3. 3
    Send a test

    Click Test. Strix posts a sample message to the channel so you can confirm it lands before real alerts flow. The panel also shows delivery health — how many notifications are pending and how many have failed.

What lands in Slack

When
In Slack
A critical alert fires
A message is posted to your channel with the alert title, severity, and source
A non-critical alert
Stays in the Strix inbox — only critical alerts notify, to keep the channel signal-heavy
Delivery fails
Strix retries; persistent failures show in the panel's failed count

You're connected when…

  • Integrations → Slack shows your saved webhook URL.
  • Clicking Test posts a sample message into the chosen Slack channel.
  • The delivery panel shows 0 failed deliveries after a successful test.
  • The next critical alert appears in the channel automatically.

Troubleshooting

Test says it worked but nothing appears in Slack
The webhook points at a different channel than you're watching, or the app was removed from the workspace. Re-add the webhook to the correct channel and paste the new URL.
Test fails with a 404 / no_service
The webhook was deleted or revoked in Slack. Create a fresh incoming webhook and save the new URL in Strix.
The field is greyed out / “managed by an admin”
Slack notifications are admin-configured. Ask an org admin to paste the webhook, or have your role elevated to Admin.
Alerts arrive in the inbox but never in Slack
Only critical alerts notify (Wazuh rule level ≥ 12, or High/critical severity from Splunk/Sentinel). Lower-severity alerts stay in the inbox by design.

Keep the webhook safe

The incoming webhook URL is a secret — anyone with it can post into your channel. Store it only in Strix. If it leaks, delete it in Slack (that invalidates it instantly), create a new one, and update it in Integrations → Slack.

Frequently asked

Critical alerts only — the same bar that auto-opens a case. Each message carries the alert's title, severity, and source. Lower-severity alerts stay in the Strix inbox so the channel doesn't turn into noise.

Want critical alerts where your team already works? We'll help you wire Slack.

Book Demo