Skip to content

Connect FirstClue to Slack

Time: ~10 min · Prereqs:

  • A FirstClue deployment, and admin rights on your organization in Kevra
  • Permission to create and install apps in your Slack workspace

What you'll set up

FirstClue joins your Slack workspace as a bot. When someone mentions it in a channel, it investigates and replies in the thread. The connection runs in Socket Mode, so you don't expose any public URL and you don't redeploy anything.

Before you begin

  • Sign in to your FirstClue console with your Kevra account. Admins of your Kevra organization are admins of the console; other members can't save integrations.
  • Confirm that you can install apps in your Slack workspace. If you can't, ask a Slack admin to install the app.

Step 1: Create the Slack app from the manifest

  1. In the FirstClue console, the onboarding wizard's Slack step has a Download the manifest link. Download the file.
  2. Open api.slack.com/apps and click Create New App.
  3. Choose From a manifest, then select your workspace.
  4. Paste the manifest you downloaded and click Create.

Step 2: Install the app to your workspace

  1. In the app settings, open Install App.
  2. Click Install to Workspace, then Allow.

Step 3: Copy the bot token

  1. Open OAuth & Permissions.
  2. Copy the Bot User OAuth Token. It starts with xoxb-.

Step 4: Create the app-level token

  1. Open Basic Information, then App-Level Tokens.
  2. Click Generate Token and Scopes.
  3. Add the scope connections:write, then click Generate.
  4. Copy the token. It starts with xapp-.

Step 5: Save both tokens in the console

  1. In the FirstClue console, open Integrations, then Slack.
  2. Paste the bot token (xoxb-...) and the app-level token (xapp-...).
  3. Click Save.

The first time you save the tokens you don't need to restart anything: the Slack connection starts within about 15 seconds. To replace tokens that are already working, contact Kevra, because the bot only reads them when it starts.

Step 6: Start your first investigation

  1. In Slack, invite the bot to the channel: /invite @FirstClue.
  2. Mention the bot with a question about an alert or an incident, for example: @FirstClue explain the latest alert on checkout-api.
  3. Read the reply in the thread. It lists the sources FirstClue used.

Verify it worked

  • FirstClue replies to your mention in the same thread, with the sources it used listed in the reply.

Troubleshooting

  • You can't save the tokens. Your Kevra account isn't an admin of the organization that owns the deployment. Ask an organization admin to save them, or to give you the admin role.
  • FirstClue doesn't answer the mention. Check that the bot is in the channel. For private channels, the invite step is required.
  • The bot doesn't connect after a few minutes. Check that the bot token starts with xoxb- and the app-level token starts with xapp- and has the connections:write scope. If the tokens are correct, contact your Kevra team.

Next steps

You're done. Next, you can connect your other integrations (GitHub, Jira, Confluence, PagerDuty, and your observability tools) from the same Integrations page.