Audit logs, security detections and anomaly responses

What the exam expects

• Filter the audit logs to one person and a time window, and read a raw entry for IP address, user agent and timestamp.
• Use the Security Detections tab to find activity Slack flagged as suspicious.
• Choose the Audit Logs API for a SIEM or custom monitoring, and exports for keeping audit data longer than Slack does.
• Configure anomaly event responses that end sessions automatically, including exclusions, notifications and their limits.
• Grant the narrowest role: Audit Logs Admin to read logs, Security Admin for sessions, a custom role for search query exports.

Key terms:

• Audit logs: the Enterprise record of changes and usage, viewed in Organization settings > Security > Audit logs. They record events, not message content.
• Anomaly event: an audit event that indicates potentially unusual or suspicious user or app activity, such as excessive downloads.
• Anomaly event response: a setting that makes Slack end a user's sessions on all devices when a chosen anomaly event is detected.
• Audit Logs API: the API Enterprise orgs use to monitor audit events programmatically.
• Enterprise org: an Enterprise organization (Enterprise Grid or Enterprise+ plan); audit logs exist only there.

Key facts

Check yourself