Install the Semgrep Slack App
PREREQUISITES
- You must be a Slack Workspace Owner to set up the Semgrep Slack app.
- Single-tenant Semgrep AppSec Platform: Reach out to your Technical Account Manager (TAM) to ensure your instance has been configured for the Semgrep Slack app.
1
In Semgrep AppSec Platform, go to Settings > Integrations.
2
On the Integrations page, click Add (or Setup First Integration if this is your first integration), and then select Slack.
3
Click Allow.
Set up notifications for findings in Slack
The commands you use depend on whether your organization has migrated to unified policies:- If your organization uses legacy policies, use
/semgrep_subscribe(Code and Supply Chain) or/semgrep_subscribe_secrets(Secrets), as described in the following sections. - If your organization has migrated to unified policies, use
/semgrep_add_channeland configure notifications from the Remediation page.
- Unified policies
- Legacy policies
If your organization has migrated to Unified policies, you must use the
/semgrep_add_channel command to make a Slack channel available to your remediation policies. Then, you can send findings notifications to the channel by adding a Send a Slack message action to a remediation policy.The projects a channel receives findings for are controlled by each remediation policy’s Scope, not by the Slack command.To set up notifications:1
In your Slack workspace, find or create a channel for Semgrep notifications.
- If you use a private channel for notifications, first invite the Semgrep app by entering the command
/invite @Semgrepin the channel. If the app is not invited to a private channel, it cannot send notifications there.
2
In the selected Slack channel, enter the following command: 
/semgrep_add_channel. This opens the Semgrep Notifications dialog.3
Choose an organization from the list under Select target organization.
4
Click Add channel. The channel is now available as an option to your remediation policies.
5
In Semgrep AppSec Platform, go to Rules & Policies > Remediation, and add a Send a Slack message action to a new or existing remediation policy. Ensure that you select the channel you configured in the preceding steps.To send findings for specific projects only, set the policy’s Scope to those projects. For more information, see Create a remediation policy.
Remove notifications for findings in Slack
NOTEThis operation removes or unsubscribes a channel from notifications. To uninstall the Semgrep Slack App, refer to Uninstall the Semgrep Slack App.
- Unified policies
- Legacy policies
To remove a Slack channel from your remediation policies:Removing a channel takes it out of your list of available channels for remediation policies and stops all remediation policy notifications to that channel.
1
In Slack, enter the channel that you want to remove.
2
Type
/semgrep_remove_channel.3
Select the target organization.
4
Click Remove channel.
Notification and alert de-duplication
Notifications are sent only the first time a given finding is detected. When running a diff-aware scan, Semgrep doesn’t notify you when a pull request has a finding that existed on the base branch already, even if that line is moved or re-indented. Semgrep also tracks notifications that have already been sent, so subsequent scans of the same changes in a pull request won’t result in duplicate notifications.NOTESee Findings in CI for more information about how Semgrep tracks a finding through its lifetime.
Uninstall the Semgrep Slack App
1
In Semgrep AppSec Platform, go to Settings > Integrations.
2
On the Integrations page, find the Slack integration you want to remove.
3
Expand the Channels receiving Semgrep notifications section and review the channels receiving notifications.
4
In the related channels in your Slack workspace, use the
/semgrep_unsubscribe command to unsubscribe from those notifications.5
After completing this step for all channels, click Remove integration > Remove.
Troubleshooting
Not receiving any findings
The following list describes possible ways to troubleshoot findings not appearing in your Slack workspace:- Check if you have successfully set up your notifications.
- Check if your most recent scan has findings to send.
- Check your filters.
- Check if the channel is private. You must add the Semgrep Slack App to any private channel to subscribe to notifications in that channel.
Check notifications
To check that your notifications are set up, you can review notifications in two places:- On the Integrations page, locate your Slack integration and expand Channels receiving Semgrep notifications.
- In your Slack workspace, click Semgrep under Apps in the Slack sidebar and review the channels under Notifications are being sent to the following channels.
- To send a test notification to a channel in this list, click the three-dot menu > Send Test Notification.
Check your filters
If you have set up any filter, such as filtering for a specific policy or project, all conditions of that filter must be present for the notification to be sent. Review your filters by following the steps in Changing Slack notification settings.Permissions not up-to-date
You may receive a message from Semgrep Slack app stating that your token does not have up-to-date permissions. Clicking the link provided in the message to update the permissions typically resolves this issue. However, if after updating the token, you still receive the same message, perform the following steps to revoke and refresh your access token:1
In your Slack workspace, click Semgrep under Apps in the Slack sidebar.
2
Click Uninstall. This revokes your token.
3
Go to Semgrep AppSec Platform > Settings > Integrations.
4
Find the Slack entry for the workspace you revoked in step 2 and click Refresh Token.
5
Follow the steps in the authentication flow to complete the token refresh.
Fixing dispatch_failed error
There are many possible causes for this error. Try the following fixes:
- Re-enter your last command or operation after a few minutes.
- Uninstall, and then reinstall your Semgrep Slack integration.