I've been trying to set up a workflow where our team gets Slack alerts directly from the Elastic Security detection engine, but I'm hitting a few snags. Our current setup is to have someone watch the Kibana alerts page, which isn't sustainable. I know Elastic has Slack integrations, but the documentation seems to jump from 'here's a webhook' to 'alerts are now in Slack' without much on the middle steps.
Could someone walk through the actual step-by-step configuration? I'm particularly fuzzy on:
* The exact setup within the Elastic Stack to format and route the detection alert data. Do you use the built-in Slack connector, or is a custom webhook more reliable?
* How you manage alert fatigue. Our detection rules can be noisy—what's the best practice for filtering which alerts actually go to Slack? I've seen mentions of using rule severity or tags.
* What the actionable part looks like. Does the Slack message include a direct link back to the alert in Kibana? Are you embedding key fields like hostname or user in the message itself?
For context, we're comparing this to how we get alerts from our cloud monitoring tools (like Datadog or AWS GuardDuty), where the Slack payload is usually very rich. How does the Elastic setup compare in terms of customization?
I'd appreciate any insights on the pipeline, especially around:
- Prerequisites in Elastic (specific user role permissions, etc.)
- The configuration order in Kibana (Rules → Connectors → Actions?)
- Common pitfalls in the message formatting using Mustache templates
A real-world example of a working connector configuration would be incredibly helpful.