Slack Message History Bulk Downloaded via API

Darshan Thummar@Mighty

•updated Jun 12, 2026•0•0•6

This rule detects when a user downloads a large amount of Slack message history via the Slack API. It specifically looks for HTTP requests to 'slack.com' with the URI '/conversations.history' and triggers an alert if 20 such requests are observed from the same source IP within a 60-second window. This behavior could indicate an attempt to exfiltrate sensitive communication data.