Slack Audit Logs and Anomalies

This post elaborates on the Anomaly Event Response (AER) system by detailing the nature of anomaly events within audit logs, distinguishing them from regular audit events. It provides practical guidance on how organizations can operationalize anomalies, emphasizing that they are indicators for further investigation rather than direct incident triggers. Specific strategies for allowlisting CIDR ranges and ASNs, correlating multiple anomalies (e.g., user_agent with excessive_downloads), and aggregating anomalies over time are discussed. The post also highlights the importance of consuming full audit logs for context when investigating anomalies and provides a detailed walkthrough of the Audit Log UI for security detections and event details, including terminating user sessions.