Just built a Slack bot that posts Claw alerts to our #security channel.

Team size: 12 engineers, 3 SREs.
Stack: AWS (MSK, EKS), ClickHouse for analytics, Snowflake for warehousing. Security team uses Panther for SIEM, but alert noise is high.

We needed Claw (our internal threat detection tool) alerts to be actionable. Slack is our incident response hub. The bot filters severity >= HIGH and posts with context.

Key requirements:
* Low latency (<5s from alert to Slack).
* Structured message with one-click link to full alert in Claw UI.
* Avoid spamming the channel.

Solution: A small Go service subscribes to Claw's Kafka alert topic, applies filtering, formats, and calls Slack's Incoming Webhook.

Core filtering logic:

```go
if alert.Severity < config.ThresholdSeverity {
return // Drop
}
if slices.Contains(config.IgnoredRuleIDs, alert.RuleID) {
return // Drop
}
```

Message builder creates a Slack block with:
* Alert title & rule ID.
* Timestamp (converted to local TZ).
* Affected resource (e.g., `arn:aws:ec2:...`).
* Direct link button.

Considered self-hosting the bot (simple K8s deployment), but opted for a managed Fargate task due to team bandwidth. Runs for ~$12/month.

Results: Alert-to-acknowledgement time dropped from ~15 minutes (email) to under 2 minutes. Channel gets ~3-5 high-signal posts per day.