Umbra
Start free
← All docs

ChatOps (Slack)

OAuth-bound Slack app with five slash commands for investigation, exploitation, and reporting, without opening the dashboard.

Last updated Jun 1, 2026

What it is

A first-class Slack integration that lets the security team operate from chat: search the surface, list findings, ask natural-language questions, kick off AI exploit runs, and generate reports, all from slash commands.

Lives under ChatOps in the dashboard (Microsoft Teams + Discord on the roadmap). Distinct from the notification channels, which push alerts; ChatOps is the inbound interactive surface.

What it produces

Five slash commands, all auth-bound to your Slack workspace ↔ Umbra workspace:

  • /umbra services: list services. Same SmartSearch token grammar as the dashboard: port:, product:, hostname:, ip:, banner:, device_type:, category:, compromised:, internal:, agent:.
  • /umbra findings: list findings. Severity + the token grammar: severity:, kind:, host:, internal:, agent:, status:.
  • /umbra ask: natural-language query. “Anything with apache exposed on port 443” / “critical sqli findings” / “what’s compromised right now.”
  • /umbra run: kick off an AI exploit run from chat.
  • /umbra report: generate a per-target or per-company summary directly into the channel.

Plus interactive Block Kit responses (drill-into-service buttons, copy-to-clipboard URLs, “open in dashboard” deep links).

What to use it for

  • Daily standup: /umbra findings status:open severity:critical in #security.
  • On-call triage: /umbra ask what compromised right now while the laptop’s in a bag.
  • Customer demos: type a query, share the response in their channel.
  • Async handoff: post a finding link, the recipient triages from Slack.

Why it matters

Security teams already live in Slack. A tool that requires context-switching to a separate dashboard for every question loses adoption. ChatOps makes the boundary between Slack and the dashboard porous: investigate from Slack, deep-dive in the dashboard.

Why it’s valuable

  • Same grammar as the dashboard. Tokens you learned for SmartSearch work in Slack verbatim.
  • No second account. Bound at install time via OAuth; every user’s identity ↔ Slack ↔ Umbra is resolved once.
  • Auth-scoped. Slash commands respect the calling user’s workspace + role, so a Slack member with no Umbra access gets nothing back.
  • Command-reference panel in the dashboard shows copy-pasteable examples so you don’t have to remember the token grammar.

How to use it

  1. Open ChatOps in the left nav → Install on Slack.
  2. Approve the OAuth flow in Slack.
  3. Use the slash commands in any channel where the app is added.

Microsoft Teams and Discord builds are on the roadmap with the same command grammar.