push connector · incoming webhook
Wytness for Slack
Anomalies arrive in the channel your team already watches. Block Kit attachments. Severity-coloured. One webhook URL to set up.
what it does
Where your alerts land
Every anomaly posts as one message to the channel behind your Incoming Webhook URL — a Block Kit attachment with a severity-coloured bar and the full alert context. No bot user, no OAuth scopes; the webhook URL is the whole integration, and Wytness stores it encrypted at rest with your org's AES-256-GCM key.
setup
From nothing to first delivery
01
In Slack, open the channel you want anomalies in. Channel name → Integrations → Add an app → search “Incoming WebHooks”.
02
Click Add to Slack, choose the channel, and click Add Incoming WebHooks integration.
03
Copy the Webhook URL Slack shows you. It's `https://hooks.slack.com/services/T<team>/B<service>/<secret>`; treat the whole URL as a secret.
04
In the Wytness app, go to Integrations → Connectors → Add connection → Slack and paste the webhook URL. Wytness encrypts it at rest with your org's AES-256-GCM key.
05
Click Test connection. A Wytness test message should land in the channel within a second.
the payload
What arrives in the channel
Colour follows severity: critical #ef4444, high #f97316, medium #eab308, low #3b82f6.
{ "text": "Wytness anomaly: off_hours_activity", "attachments": [ { "color": "#f97316", "title": "View in Wytness", "title_link": "https://app.wytness.ai/anomalies?alert_id=9f2d1c34-8a7b-4e2d-b1a0-5c6d7e8f9a0b", "fields": [ { "title": "Agent", "value": "payments-reconciler-v3", "short": true }, { "title": "Severity", "value": "high", "short": true }, { "title": "Rule", "value": "off_hours_activity", "short": true }, { "title": "Alert ID", "value": "9f2d1c34-8a7b-4e2d-b1a0-5c6d7e8f9a0b", "short": true }, { "title": "Description", "value": "Tool invocation outside business hours window (08:00-18:00 AEST).", "short": false } ], "ts": 1779546221 } ]}prove it landed
Verify end to end
The wizard's Test connection posts a real message before you save. To sanity-check a webhook URL on its own first:
# Smoke-test the webhook URL from your laptop before pasting it into# Wytness. If you see a message in the channel, the URL works. $ curl -X POST \ -H "Content-Type: application/json" \ --data '{"text":"Wytness handshake, ignore."}' \ "https://hooks.slack.com/services/T00000000/B00000000/XXXXXXXXXXXXXXXXXXXXXXXX"the boundary
What flows and what doesn't
Writes
One message per anomaly to the single channel pinned on the webhook URL
Format
Block Kit attachment with severity-coloured bar, agent, rule, alert ID, description
Auth
None. The URL itself is the secret. Wytness stores it encrypted at rest.
Reads
Nothing. Wytness can't read your channels or messages.
Network
No change on your side — deliveries go to Slack's webhook endpoint, outbound from Wytness.
what you need
Required permissions
- ✓Workspace permission to add an Incoming WebHook to the target channel
- ✓(That's it. No bot user, no OAuth scopes, no Wytness side-channel needed.)
stated plainly
Limitations
—
One channel per webhook
An Incoming Webhook URL is pinned to the channel it was created in. To route different severities to different channels, create one Wytness connection per channel and give each its own severity or rule filters.
—
No interactive Approve / Deny
Block Kit buttons that act on a Shield request from the message body belong to the multi-channel Slack-bot integration, a roadmap item — today's connector is one-way notification via the webhook URL.
—
PII pseudonymisation
Anomalies sent to Slack are already pseudonymised. The channel sees the same EMAIL_a3f9b1c4 pseudonym shape your auditor sees in the Evidence Pack; no raw PII in the channel.
related
Keep reading
/docs/connectors
Connector setup guide
The full integrator contract — network requirements, delivery semantics, and every wizard field. Read the guide.
/connectors
All connectors
Sentinel, Splunk, ServiceNow, Slack, and the generic webhook. See the index.
tier
Tier availability
Business plan or higher.