Building Slack’s Anomaly Event Response

This post details the design philosophy of AER, prioritizing common threat types such as Tor access, excessive downloading, data scraping, session fingerprint mismatches, and unexpected API volumes. It elaborates on the system architecture, including the detection engine's use of rule-based heuristics and dynamic thresholds calibrated to enterprise usage patterns, the decision framework's validation of anomalies against customer configurations and internal rules, and the response orchestrator's session termination, audit log generation, and configurable notification mechanisms. It also highlights key findings and impact, emphasizing the reduction in data breach response time and cost.