Learn about security solutions and standards
Care about security? We do too. Learn what Atlassian does and what you can do too.
Send alerts to a SIEM, Slack, or other tools
Beacon will soon be part of Atlassian Guard. Read the blog
You can send alerts about suspicious activity or potentially sensitive data to any destination using webhooks. This is useful if you already use a Security information and event management system (SIEM) or other tool to monitor your organization.
Who can do this? |
Send alerts to Slack
You can send alerts to one or more Slack channels.
To send alerts to Slack:
In Beacon, select Integrations > Slack from the header.
Select Connect new channel.
Specify which Slack channel to send alerts to.
Select Allow.
To test the integration is working, send a test alert.
Send alerts to Microsoft Teams
The Microsoft Teams integration uses webhooks. How to create an incoming webhook in Microsoft Teams
To send alerts to Microsoft Teams:
In Beacon, select Integrations > Teams from the header.
Select Add webhook.
Enter the incoming webhook URL, and select Save.
To test the integration is working, send a test alert.
Send alerts to a SIEM or other tool
You can use webhooks to send alerts to any destination, such as a SIEM, or an automation tool like Jira Automation, Zapier, or Workato.
Check the documentation for your tool to find out how to create a webhook URL. This is where we’ll forward the alerts.
To send alerts to a SIEM or other tool:
In Beacon, select Integrations > SIEM forwarding.
Select Add webhook.
Enter the Webhook URL, and select Save.
What data is sent to your tool?
It’s important to know that once you set up an integration you will be sending alert data to the third party tool of your choosing. We send the alert title, description, and context which can include:
The name of the actor and their profile picture
The name of the subject, which can be a person or an entity (such as a space, project, or policy)
The site URL or page URL where the activity happened.
We respect the visibility settings in the actor’s Atlassian Account profile. If the actor has chosen not to share their profile picture with their Atlassian organization, we respect that setting.
You should make sure that it’s appropriate for this data to be shared with your third party tool before setting up the integration.
Here’s an example alert in Slack.
Was this helpful?