Slack Mass User Deactivation in Workspace

Siddhant Mishra@Siddhant

•updated yesterday•0•0•0

Detects a burst of user deactivations in a Slack workspace. Mass deactivation locks colleagues out of the channel an organisation uses to coordinate its own incident response, which is both disruptive in itself and a way of blinding the responders while something else proceeds. Onboarding: SLACK is ingested via Slack native connector (Bloo extractor 833). Integration guide: https://bloo.io/docs/integrations/slack BQL (Bloo Query Language): stream=iam where sourcename='SLACK' and action='USER_DEACTIVATED' | duration 1h | groupby user | select user, distinct_count(targetuser) | having distinct_count_col1 > 5