Slack External Account Joined Workspace
Detects an account joining the workspace. Slack Connect and guest access let outside identities into an internal communication space, and an unexpected join is how an attacker gains a listening position without touching the network perimeter at all. Check the account type: a guest or external identity joining a channel carrying operational or security discussion is worth immediate confirmation with the inviter. Onboarding: SLACK is ingested via Slack native connector (Bloo extractor 833). Integration guide: https://bloo.io/docs/integrations/slack BQL (Bloo Query Language): stream=iam where sourcename='SLACK' and action='USER_JOINED_WORKSPACE' | groupby user, targetuser, accounttype, workspace
Sigma
