An integration token was used from a new network. This is an anomaly to investigate; compromise has not been confirmed.
Incidents and operations / BLOCK KIT JSON
Route a security finding to its owner with severity, affected scope, and a safe investigation link.
Blank optional fields are omitted. Fallback text updates with your fields.
Approximate Slack rendering. Buttons are visual previews; no actions are sent.
Local validation checks the supported schema. It does not guarantee Slack API acceptance.
Manual editing and validation run in your browser. Opening Slack’s Builder shares the message with Slack.
Security finding · Review required An integration token was used from a new network. This is an anomaly to investigate; compromise has not been confirmed. Severity: High · pending triage Affected scope: Production integration · token ending 7c2a Assigned team: Security operations Observed: 20 Oct 2026 · 14:26 UTC SEC-284 · Evidence is available to authorized responders only. Investigate finding: https://example.com/security/SEC-284
Download the payload or use this command in your own terminal. Replace the placeholder URL with your Slack incoming webhook. Keep the real URL secret. This tool never sends a Slack message.
curl --request POST \
--header 'Content-Type: application/json' \
--data-binary @- \
'https://hooks.slack.com/services/YOUR/WEBHOOK/URL' <<'SLACK_MESSAGE_JSON'
{
"text": "Security finding · Review required\nAn integration token was used from a new network. This is an anomaly to investigate; compromise has not been confirmed.\nSeverity: High · pending triage\nAffected scope: Production integration · token ending 7c2a\nAssigned team: Security operations\nObserved: 20 Oct 2026 · 14:26 UTC\nSEC-284 · Evidence is available to authorized responders only.\nInvestigate finding: https://example.com/security/SEC-284",
"blocks": [
{
"type": "header",
"text": {
"type": "plain_text",
"text": "Security finding · Review required"
}
},
{
"type": "section",
"text": {
"type": "mrkdwn",
"text": "An integration token was used from a new network. This is an anomaly to investigate; compromise has not been confirmed."
}
},
{
"type": "section",
"fields": [
{
"type": "mrkdwn",
"text": "*Severity*\nHigh · pending triage"
},
{
"type": "mrkdwn",
"text": "*Affected scope*\nProduction integration · token ending 7c2a"
},
{
"type": "mrkdwn",
"text": "*Assigned team*\nSecurity operations"
},
{
"type": "mrkdwn",
"text": "*Observed*\n20 Oct 2026 · 14:26 UTC"
}
]
},
{
"type": "context",
"elements": [
{
"type": "mrkdwn",
"text": "SEC-284 · Evidence is available to authorized responders only."
}
]
},
{
"type": "divider"
},
{
"type": "actions",
"elements": [
{
"type": "button",
"text": {
"type": "plain_text",
"text": "Investigate finding"
},
"action_id": "finding",
"url": "https://example.com/security/SEC-284",
"style": "primary"
}
]
}
]
}
SLACK_MESSAGE_JSONNotify a restricted response channel about a security finding that needs triage. The message states what was observed and what needs investigation, without declaring an unverified compromise or exposing sensitive evidence.
Keep evidence in your access-controlled security system and link to it. Replace the sample scope and severity with your triage result. Do not include credentials, raw personal data, or exploit details in a broadly visible channel.
Choose a channel with appropriate access and route the alert from your security tooling. The investigate button does not revoke access, quarantine assets, or acknowledge the finding.
To post this JSON, create a Slack app with an incoming webhook for your channel, or use chat.postMessage with the appropriate bot token and permissions. Keep credentials on your server.
For buttons, enable Interactivity and handle Slack’s interaction requests, including URL buttons. Acknowledge requests promptly. This preview does not execute actions, authorize users, or save decisions.
Use the top-level fallback text for notifications and accessibility. Test your final payload in Slack; local validation covers the declared subset, and visual details vary by client.
Slack interaction setup ↗