> Source: [sk166433](https://support.checkpoint.com/results/sk/sk166433)

# sk166433 - How to configure CloudGuard Dome9 to send events to Slack

| Property | Value |
|----------|-------|
| Solution ID | sk166433 |
| Date Created | 2020-05-03 |
| Last Modified | 2020-06-22 |
| Technical Level | General |
| Products | Cloud Firewall |
| Versions | R82.10, R81.20, R82 |

## Solution

This note describes how to configure CloudGuard Dome9 to send event messages to a Slack channel.  
The connection uses an HTTP endpoint, and involves configuring an App on Slack, and a Notification Policy on Dome9.  

Once configured, Dome9 alerts (from Posture Management) can be sent to Slack channels.  

Alerts are sent as summary reports, for each assessment (a ruleset applied to an account), which summarize the number of issues, by severity, and the top issues. Alerts for all platforms (AWS, Azure, GCP, Kubernetes) can be sent to Slack. The report indicates the number of new findings (from the previous report). Slack will show these, as well as the number of resolved findings (findings from previous reports that are not in the latest report).  

Configure Slack
---------------

**Note** : it is assumed that these steps are performed by a Slack admin.

1. Create a channel in your Slack workspace (say, #*Dome9-events*).
2. Navigate to api.slack.com/apps
3. Click **Create New App**.
4. Enter a name for the app, and select the Workspace, and channel (per step 1)
5. Scroll to **Incoming Webhooks** , and select Activate.  
   ![](https://sc1.checkpoint.com/sc/SolutionsStatics/sk166433/Slack-app-activate-in-webhooks20200423161819.png)
6. Click **Add New Webhook to Workspace.**
7. Select the channel and workspace. You will be prompted to allow the app access to the channel.  
   ![](https://sc1.checkpoint.com/sc/SolutionsStatics/sk166433/Slack-app-new-WH20200423162414.png)
8. Click **Allow** .  
   **Note**: this step must be performed by a Slack admin user. If you are not an admin user, wait for an admin to Allow this, then proceed.
9. Copy the URL.  
   ![](https://sc1.checkpoint.com/sc/SolutionsStatics/sk166433/Slack-app-new-WH-URL20200423162539.png)  

Configure Dome9
---------------

1. Create a Notification Policy (in the Notifications page in the Alerts \& Notifications menu).  

2. Select **Preview Integrations** , and paste the URL from above.   
   ![](https://sc1.checkpoint.com/sc/SolutionsStatics/sk166433/2020-06-22 08_44_30-Dome9 _ Manage Notifications202006220848301.png)  

3. In the **Posture Management** menu, create a Compliance Policy (in the **Compliance Policies** page), using the Notification Policy created in the previous steps, for an account (or group of accounts) and a ruleset (or group of rulesets).  
   ![](https://sc1.checkpoint.com/sc/SolutionsStatics/sk166433/ComplPolicy20200423164153.png)
4. Click **Send all Alerts** on the policy, to send all existing alerts to Slack (for example, to test the channel).

View events on Slack
--------------------

On Slack, the Dome9 events will be sent to the channel selected (*#Dome9-events* , in the example above).  
This shows new findings, and resolved issues (since the last report).  
![](https://sc1.checkpoint.com/sc/SolutionsStatics/sk166433/SlackChannel20200423165135.png)

---

# Agent Instructions

This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.

## Navigating This Knowledge Base

- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content