Distributed Security Alerting

This thread tracks the evolution of Slack's distributed security alerting system. Initial posts detail the challenges of detecting security incidents in a timely manner and the limitations of traditional methods like manual log tailing or 24/7 SOC operations. This post introduces a novel approach where monitoring systems trigger alerts directly to the involved employee via Slack bot. The system leverages a two-factor confirmation (Slack reply + mobile push) to validate suspicious activity, significantly reducing the detection-to-response window and deputizing all employees as part of the security team. It also addresses the risk of compromised accounts by incorporating out-of-band communication for confirmation.