Sublime Security high experimental mql

DLP: Slack Token

Detects messages containing Slack API tokens and webhooks.

View Source

Detection Logic

type.outbound
and any([body.current_thread.text, subject.subject],
        // Slack tokens: xoxb-, xoxp-, xoxa-, xoxr-
        regex.contains(., '\bxox[bpar]-[0-9]{10,13}-[0-9]{10,13}-[A-Za-z0-9]{24,}\b')
        // Slack webhook URLs
        or regex.contains(., 'hooks\.slack\.com/services/T[A-Z0-9]+/B[A-Z0-9]+/[A-Za-z0-9]{24}')
)

Field Validations

Loading…

Comments (0)

Loading comments...