CyberCLI
Sign in →

← All recipes · Delivery

Set up CYCON-aware Slack routing

~7 minutes

Configure Slack to fire only at CYCON 3 or below so peacetime noise stays out of your operator channel — without losing high-CYCON alerts.

Last updated 2026-06-07 · 4 steps

§1

Prerequisites

§2

What you'll do

You'll create a Slack incoming webhook, add it as a delivery destination, and configure the routing matrix so Slack fires only at CYCON 3 or below. CYCON 4 (vigilance) and CYCON 5 (peacetime) won't post; CYCON 1-3 will.

§3

Steps

Step 1

Create the Slack incoming webhook

From the Slack admin console, create a new incoming webhook pointed at your target channel. Slack returns a URL of the form `https://hooks.slack.com/services/T0xx/B0xx/...`.

This URL is the bearer credential for posting to the channel; treat it like an API key.

Verify

The Slack admin UI shows the webhook is enabled. Note the URL — you'll paste it next.

Step 2

Add the destination on /channels

From the CyberCLI dashboard, open /channels → New destination → Slack. Paste the webhook URL into the field. The dashboard vaults it on save (you'll never see the URL again).

Give the destination a name like `soc-alerts` so the routing matrix can reference it cleanly.

$ cybercli channels test soc-alerts
Verify

The CLI test sends a synthetic alert to your channel. You see the block-kit message land in #soc-alerts. The audit log carries a `notification_sent` row with `parameters.channel: slack`.

Step 3

Configure the routing matrix

Open /delivery. The matrix is a 5 × N grid (5 CYCON levels × your enabled channels). Find the Slack column.

Click the cells for CYCON 1, 2, and 3 to enable. Leave CYCON 4 and CYCON 5 disabled (gray). Every cell flip writes a `delivery_routing_set` audit row.

Verify

The matrix shows Slack as green for CYCON 1-3 and gray for CYCON 4-5. The audit chain advances by 3 rows (one per cell flip).

Step 4

Synthesize a CYCON drop + verify routing

From the dashboard's CYCON switcher, drop preview CYCON to 3. (Preview mode doesn't change live posture; it lets you rehearse routing.)

If your install has a recent signal, the dashboard's /notifications page will show a would-have-fired entry under Slack. If not, you can synthesize a test alert via the /delivery test panel.

Verify

Your Slack channel receives the test alert during the CYCON 3 rehearsal. A second test at CYCON 4 (peacetime) doesn't post.

§4

Verify end to end

§5

Troubleshoot

Test message doesn't reach Slack; audit row shows `notification_failed`.

Cause Webhook URL is invalid or Slack returned 4xx (e.g. webhook revoked).

Fix Verify the webhook is enabled in the Slack admin UI. If it was revoked, create a new one and update the vaulted URL via /channels → soc-alerts → Edit.

Slack receives every test even when the matrix cell is gray.

Cause You're running multiple destinations and one of them is still routing the signal. Or the matrix override didn't save (rare).

Fix On /delivery, click the gray cell again — it should toggle off (you may have toggled to dry-run instead of off). Check /audit for `delivery_routing_set` rows to confirm the state.

Slack receives messages but the block-kit formatting is broken.

Cause Slack workspace has block-kit disabled (rare) or you've customized the template incorrectly.

Fix Restore the default template via /channels → soc-alerts → Edit → Reset template. If the issue persists with the default, file an issue at github.com/cybercli/cybercli.

What to do next

Install CyberCLI from scratch

From a fresh Ubuntu VM (or LXC) to a running engine with the dashboard open at /first-30-minutes, in about 8 minutes.
Connect your first Wazuh manager

Point CyberCLI at an existing Wazuh manager, watch the first alerts flow through the SOC pipeline, and verify the audit chain advances.