Slack is a team communication and collaboration tool. Onna integrates with Slack's Discovery API to extract all related data and metadata from entire Slack workspaces, specific user accounts, specific channels, and/or private/multiparty chats.

For a short video overview of collecting from Slack Enterprise, please see below:

This article describes our integration with Slack's Discovery API. The Discovery API does need to be enabled on your Enterprise Grid Account if it hasn't been already. If you are not on the Enterprise plan you can also see our standard Slack collection guide. The main differences between standard and enterprise Slack collections are:

The standard collection is unable to capture edits and deletes while the enterprise level can (assuming that the retention policy is set to retain edits and deletes in Slack).
The standard collection requires the credentials for each user in order to perform the collection, while the enterprise collection can be performed by the Slack Org Owner.

For additional questions, please contact us at contact@onna.com.

Integration Features

Prerequisites:

To enable a Slack Enterprise Grid collection, you'll need a Slack Enterprise Owner account.
The Slack Discovery API must be enabled on the account.

What is collected?

Onna's Enterprise Slack integration can be set up to collect Slack data with a few options.

All or selected workspaces
All or selected channels, both private and public
Messages posted on channels, direct messages (DMS), and multi-person instant messages (mpim)
Edited and deleted messages (only available if 'Keep Everything' is selected as a setting in Slack Enterprise)
Files posted on channels, DMs and mpims
Recorded Slack audio and video clips
Posts created in the files section, channels, DMs and mpims
Snippets created in the files section, channels, DMs and mpims
Files created in the files section, channels, DMs and mpims
All Slack Emoji reactions (On initial sync), DMs and mpims

Onna's sync modes

We currently support two syncing modes - one-time sync and auto-sync & archive.

One-time sync is sync that collects files in a source during a certain time range or up until the date the source was added.
Auto-sync & archive means that Onna will perform a full sync first and will continuously add any new files generated at the data source. The sync type does not delete files deleted from the data source

Onna can be used to collect an entire organization's workspace or specific user accounts within an organization's workspace. Onna can collect all or specific channels, all DMs, and/or private channels.

Note: Pay As You Go users and Free Trial users can only create one-time sync datasources. If you would like to upgrade your account for archive collections please contact our customer success team.

Sync Time
Sync time depends on a number of factors including, but not limited to, the length of time the individual(s) has been active in Slack, the number of channels synced, how active the channels are, and the number of files shared in channels and direct message chains.

Data Exports

Yes, you can export data and metadata in eDiscovery ready format. Load files are available in a dat, CSV, or custom text file.

The following metadata fields are exported:

Workspace ID (Alphanumeric string assigned to the workspace by Slack)
Workspace Name
Thread Name (Name of the Channel)
Thread ID (Alphanumeric string assigned to channel by Slack)
Thread Type (This specifies whether its a channel, direct message (DMs), or multi-party message (mpim)
The extension (HTML if chat file, original file format if attachment)
Filename
File creation
File last modified

Download Sample Export

How-to Guide

For this integration, you'll need to be an admin in Onna to have Slack Enterprise enabled. This role is available to our Enterprise users.

Note: Only Enterprise Grid accounts that have the Discovery API enabled will be able to use the Discovery integration. Additionally, only Org Owners can access multiple workspaces. Head to Slack for more details on Slack Roles & Permissions.

Once you're an admin on Onna and have Slack Enterprise enabled, you'll see it available as a source in the user dashboard.

Once you click on Slack Enterprise, it will open the following modal

Use GovSlack Enable this option if you're using GovSlack. GovSlack is a special version of Slack built for the public sector. For more information, visit GovSlack’s site.

The first section covers the Source name. This is the name of your source in Onna. We've pre-filled it with the name of the source you're adding however this is entirely customizable.

The next section allows you to select your synchronization mode and any optional starting date you wish. For One Time Sync, you can enter an optional start and end date.

Once you've named your source and added dates if needed, click 'Connect.' This will take you through Slack's OAuth flow where you'll be giving permissions to Onna to collect from that enterprise account.

The first step will ask for your workspace name if you're not already signed in. This workspace needs to be the "enterprise" workspace, generally [company].enterprise. You will later be able to narrow down the collection to just one of the workspaces on your enterprise account.

After you've entered your workspace URL, it will ask for user credentials.
Note: To enable a Slack Enterprise Grid collection, you'll need a Slack Enterprise Owner account.

Once you've entered that information, Slack will ask for your permission to authorize Onna to access the account.

Click Authorize to finalize the OAuth process.

The next section allows you to specify what you'd like to sync from Slack.

Note: You will want to toggle OFF "Custodian Collection" in order to set up an archive source. Check out the article on User-Based Collections for more information.

You can choose to collect the entire account or specific parts.

There are the following options:

Direct Messages
Multiparty Messages (messages between two or more individuals. These aren't channels)
Workspace private channels (private channels in a workspace)
Workspace public channels (public channels in a workspace)

Note: One of the benefits of using Onna's integration with Slack Enterprise is its granularity. If you're just looking at collecting conversations from users and not interested in channels, just select 'Direct Messages' and 'Multiparty Messages' to head straight to user selection. Conversely, if you are just interested in channels, you can only select the different channel options.

Note: Direct Messages and Multiparty Messages reside at the Slack organizational level, they are not related to any specific Slack Workspace. This means they can only be limited in scope by user accounts selection and not by Slack Workspaces. Be cautious of how many collections in the same Onna workspace include Direct Messages and Multiparty Messages because duplicates may occur.

Once you're finished, click 'Next'

You will see the list of workspaces that you can expand and select/deselect.

Loading large numbers of Organization-wide and Multi-workspace channels can take a significant amount of time across large enterprise accounts. For Organization-wide and Multi-workspace channels you have the option to not load, load all, or load only those channels for selected workspaces:

1) Do Not Load - This option will not load any organization or multi-workspace channels;

2) Load All - This will load all organization and multi-workspace channels independent of the workspaces selected

3) Load only those for selected workspaces - This option will load all organization-wide channels, but filter the multi-workspace channels to include only those from the selected workspaces. In order to filter these channels, a number of requests need to be made, which causes this option to take the longest.

Beneath that you can choose to sync multi-workspace channels and externally shared channels for the selected workspace. On this page, you can also choose whether to sync workspaces created in the future if your source is in auto-sync and archive.

Channel Selection
The next step in setting up the Slack Enterprise Grid integration is the Channels selection. The total number of channels is listed in the top left.

Note: If you only selected Direct and/or Multiparty Messages, you will skip the channel selection screen.

You can search for channels by using the filter. Private channels are shown with a lock icon beside their name.

If your source is in auto-sync and archive you will have the option to sync future channels. New channels that are added to Slack will automatically be added to Onna.

Direct Message Selection

Onna will need to gather all user accounts related to Slack. If you have over 5000 users on your account, this process may take up to a minute. Once loaded you can select your desired user accounts to sync.

At the top of the page, you will have additional filters for the email domain. Clicking on the email domain will give you a list of all the email domains that are available for your account.

At the bottom of the page, you can also choose whether to sync future channels if your source is in auto-sync and archive. New channels that are added to Slack will automatically be added to Onna.

Once you've made your selection you can click Done. The Slack Enterprise account will be listed in your Sources.

Searching across the account

Files will be visible on the user dashboard. If you mapped them to a single user, head to that user's account. Results will begin populating as soon as the connection is made.

Channels and conversations are HTML files. A file is created every 24hrs and is saved in UTC. The standard title for chat files will be:

Type of chat [e.g. channel, personal message], name of the channel or person [e.g. general, random], the participant(s), and date [YYYYMMDD]

Attachments that are sent through chats are extracted and processed separately.

Slack Files in Onna

On the left-hand side, you have the HTML file. You can see the naming convention mentioned before: Type of chat [e.g. channel, personal message] name of channel or person [e.g. general, random], the participant(s), and date [YYYYMMDD]

Each message contains the user name and the time and date stamp (UTC) the message was sent. The most recent messages appear at the bottom.
The third message demonstrates the example of an attachment that has been shared through Slack. Onna offers a link to view the attachment separately and also lists the document in the document details tab on the right. The attachment will open in its native format, in this case, PNG.

Edited & Deleted Messages

If you have 'Keep Everything' as a setting across public channels, private channels, and direct messages in your workspace (only available for Slack Enterprise Grid), you will be able to see edited and deleted messages in Onna. Below is an example of how they are displayed:

We demonstrate edited messages in green and deleted messages in red. Starting from April 2019, Onna also started adding "Has Deletions" or "Has Edits" on conversations that have had deletes or edits. You can easily search for conversations that have been modified by searching "has edits" or "has:deletions", through the search bar.

Slack Emoji Reactions

Slack Emoji reactions are also available for searching and exporting inside of Onna. To assist with your Emoji searches we have added the new keyword “has:reaction” to locate all of your Slack messages with Emoji content.

To export those reactions, make sure to select Message List and “List of Messages,” under Source-specific metadata in your Configuration window.

Back in the results screen, you are able to filter results by date range, categories, and/or extensions using the menu on the left.

From that same screen, you can also sort by different columns and choose other metadata fields to sort by using the toggle on the right-hand side.

Clicking on the information icon on the top right will take you to the source details where you can see how many files it has and its size.

At the bottom of your Source details panel are your origin details which can give more information regarding the settings chosen for your Slack sync. You can review your selected Sync-mode, whether future channels and users will be added as well as the threads synced in Synced threads. The source's time range, and when the source was last synced are also available as well.

For admin creators of the Slack Enterprise source, you will also be able to see a list of users that have been synced from that account by clicking the info icon and expanding Synced account in origin.

Click on Audits to see logs from collection and processing

FAQ

What do I do if I am receiving a “team_not_authorized” error when trying to connect Slack Enterprise?

If you are receiving this error, please check to see if you have the Discovery API enabled. If you continue to run into issues, please reach out to Slack to ensure the Discovery API is indeed enabled and if it is not enabled, please have them enable it for the Slack environment.

What are “active” participants in a Slack conversation?

Active participation is either being a sender of a message (or reply) or reacting to a message on that day.

Who is notified within Slack Enterprise when Onna is added as an application?
This depends on your settings! By default, the person who added the application is the one that receives the email through Slack.

Does Onna collect edited and deleted messages across everything?
Yes, if the account in question has "Store Everything" enabled across channels, private channels, and messages. There are some accounts that opt-out of storing everything which means that we cannot collect previously edited or deleted messages.

If I select specific users, will I get only the channels that they are subscribed to on Slack?
No, you will get all of the channels that you selected during the channel selection stage. The list of channels that you can see there is for the entire Slack account.

If you'd like to complete a more targeted collection for user-specific information, check out our user-based Slack collection using the Audit API for Slack Enterprise Grid.

How do I collect only direct messages for users?
Simple! Select 'Direct Messages' and 'Multiparty Messages' and as long as the rest of the scopes are not selected, it will take you straight to the user selection stage.

Once a collection has started, can one modify the details? Can you add another user or another channel?
No - currently once the collection is started in Onna it cannot be modified. To collect another user's messages or add another channel one has to go through the 'Add Source' process again.

Can you export the files in PDF?
Yes, Slack conversations are HTML natives. These can be converted into PDF files.

How do Onna exports differ from Slack's standard exports?
Onna's exports differ in a couple of ways. Slack's standard exports are JSON files that require further processing before you can use them in a review platform. Each JSON object consists of one message along with the metadata for that message. One has to parse the file and assign control numbers for each individual message on every channel and every direct message, then sort and view each message from each conversation individually.

Onna's exports are processed and ready to be loaded into a review platform. We divide messages up by day so that the volume that is being reviewed is less and it's easier to see the context around messages.

With Onna, you can also filter down the amount that is being exported down to the specific person or channel (private or public) that one wants to review. This is different from the standard export which generally exports everything associated with a workspace.

Finally, Onna collects all attachments in their original format. In the JSON objects attachments are stored as links which means they will not be part of the initial search parameters when going through review.

Are archived channels able to be synced in Onna?
Yes, archived slack channels (private or public) that are still available via the API would sync unless the data has moved past the retention setting. However, deleted channels in Slack are not able to be synced.

In what order will Slack files sync?
When Slack sync starts files are collected in the following order:

Public channels
Private channels
Direct messages (DMs)
Multi-party messages (MPIMs)

Why do I see different dates within the Slack conversation?

Slack conversations have a File creation date, a Last modified date and message dates which appear next to the messages. If the Slack conversation has edits or deletions that happened after the original conversation date, the different dates and times correspond with when the edit or deletion occurred.

How can I identify the custodian to my files in my Slack Enterprise export?

For channel-based collections, the export CSV will have the users in the RelatedUsers_List of related users field. For custodian-based collections, the export CSV will populate custodian values into Origin_List of users collected for the field. Onna will store up to 10,000 users information per resource (conversation-day) in the related users field.

Does Onna collect the user's IP address and the user agent from Slack Enterprise?

No, currently Onna does not collect the user's IP address and the user agent from Slack.

Can Onna tell us who responded with an emoji reaction?

Yes, you can export with the message list option in your metadata-export configuration settings and view which users sent which emoji reactions in your MessageList_List of messages field.

Can Onna collect Slack calls and Huddles?

For Slack calls & Huddles we are able to collect the user who initiated the call, timestamp when the call took place, and the URL of the call. Information such as the in meeting chat & transcript of the call is not available. Please note that Slack does not support the ability to record or transcribe Slack calls/Huddles. Additional information can be found in Slack's help center.

Can Onna capture and replay Slack audio/video recordings?

Yes, Onna will capture & process the new Slack audio/video recording feature that can be sent within channels, DM's, and MPIM. Once the Slack conversations has successfully synced into Onna the recordings will be available to play & view within Onna.

Are deleted or updated reactions to messages captured in Onna?

We will only retrieve reactions at the moment in time when the conversation is synced into Onna. If the message that contained the reactions is deleted, Onna will show the original message was deleted but the reactions will not be displayed.

Have a question that we haven't answered here? Interested in collecting from Slack Enterprise?

Contact Onna