Slack Workflow Published to Workspace

Siddhant Mishra@Siddhant

•updated yesterday•0•0•1

Detects a Slack workflow being published. Workflows run automation inside the workspace — they can post, collect responses, and reach external endpoints via webhooks — which makes a malicious one a credential-harvesting form or an exfiltration channel that looks like an internal tool. Onboarding: SLACK is ingested via Slack native connector (Bloo extractor 833). Integration guide: https://bloo.io/docs/integrations/slack BQL (Bloo Query Language): stream=slack-workflow where sourcename='SLACK' and action='PUBLISHED' | groupby user, workflow