The Semgrep Slack app enables Semgrep AppSec Platform to notify you of new findings after every scan. By receiving notifications within your Slack workspace, developers and security engineers can see findings without switching environments. This can lessen the friction between detecting a finding, triaging it, and resolving it.You can select the channels in your Slack workspace that receive finding notifications. You can also choose to receive notifications only for certain repositories (projects) or Rule Modes.Semgrep Code supports Policy-based filters for notifications. For example, you can choose to receive notifications only for findings generated by rules from the Blocking Rule Mode.
You must be a Slack Workspace Owner to set up the Semgrep Slack app.
Single-tenant Semgrep AppSec Platform: Reach out to your Technical Account Manager (TAM) to ensure your instance has been configured for the Semgrep Slack app.
To install the Semgrep Slack app, follow these steps:
The commands you use depend on whether your organization has migrated to unified policies:
If your organization uses legacy policies, use /semgrep_subscribe (Code and Supply Chain) or /semgrep_subscribe_secrets (Secrets), as described in the following sections.
If your organization has migrated to unified policies, use /semgrep_add_channel and configure notifications from the Remediation page.
Unified policies
Legacy policies
If your organization has migrated to Unified policies, you must use the /semgrep_add_channel command to make a Slack channel available to your remediation policies. Then, you can send findings notifications to the channel by adding a Send a Slack message action to a remediation policy.The projects a channel receives findings for are controlled by each remediation policy’s Scope, not by the Slack command.To set up notifications:
1
In your Slack workspace, find or create a channel for Semgrep notifications.
If you use a private channel for notifications, first invite the Semgrep app by entering the command /invite @Semgrep in the channel. If the app is not invited to a private channel, it cannot send notifications there.
2
In the selected Slack channel, enter the following command: /semgrep_add_channel. This opens the Semgrep Notifications dialog.
The Semgrep notifications dialog in Slack, opened with the /semgrep_add_channel command.
3
Choose an organization from the list under Select target organization.
4
Click Add channel. The channel is now available as an option to your remediation policies.
5
In Semgrep AppSec Platform, go to Rules & Policies > Remediation, and add a Send a Slack message action to a new or existing remediation policy. Ensure that you select the channel you configured in the preceding steps.To send findings for specific projects only, set the policy’s Scope to those projects. For more information, see Create a remediation policy.
To set up or subscribe to notifications for findings in your Slack workspace, perform the following steps:
1
In your Slack workspace, find or create a channel for Semgrep notifications.
If you use a private channel for notifications, first invite the Semgrep app by entering the command /invite @Semgrep in the channel. If the app is not invited to a private channel, it cannot send notifications there.
2
In the selected Slack channel, enter the following command: /semgrep_subscribe.
3
Optional: Enter the name of a specific project after /semgrep_subscribe to receive findings for that specific project only. The project must be entered as it is shown in Semgrep AppSec Platform, typically: /semgrep_subscribe ACCOUNT_NAME/REPOSITORY_NAME
4
Choose an organization in the list under Select target organization. The dialog box expands with additional options.
5
Optional: Set up additional filters.
For users receiving both Semgrep Code and Semgrep Supply Chain findings: Use Target scan type to choose whether to receive notifications for Semgrep Code, Semgrep Supply Chain, or both.
For Semgrep Code users only: In the Selected Policies field, choose the specific policies you want to receive findings for. By default, all policies are selected, including Monitor policy, which may result in a higher volume of notifications.
6
Click Subscribe. If you did not specify a project after /semgrep_subscribe, the channel is subscribed to findings from all your projects in Semgrep AppSec Platform.
7
Optional: To set up Slack notifications for additional workspaces, repeat steps 1 to 6. The Semgrep Slack integration is set up on a per-workspace basis.
You have successfully set up notifications for Semgrep findings. The Semgrep Slack app reports new findings after every scan but does not report findings that were previously discovered.
SUGGESTED WORKFLOWIn your Slack workspace, create separate channels for either policies, repositories (projects), or types of findings depending on your business or development need. This ensures that developers receive only findings that are relevant to them.
To set up or subscribe to notifications for findings in your Slack workspace, perform the following steps:
1
In your Slack workspace, find or create a channel for Semgrep notifications.
If you use a private channel for notifications, first invite the Semgrep app by entering the command /invite @Semgrep in the channel. If the app is not invited to a private channel, it cannot send notifications there.
2
In the selected Slack channel, enter the following command: /semgrep_subscribe_secrets.
3
Choose an organization in the list under Select target organization.
4
Click Subscribe. You can now configure Semgrep Secrets notifications for this channel.
5
This channel is now ready to receive Semgrep Secrets notifications. To configure when notifications are sent, create a Semgrep Secrets policy.
6
Optional: To set up Slack notifications for additional workspaces, repeat steps 1 to The Semgrep Slack integration is set up on a per-workspace basis.
NOTEThis operation removes or unsubscribes a channel from notifications. To uninstall the Semgrep Slack App, refer to Uninstall the Semgrep Slack App.
Unified policies
Legacy policies
To remove a Slack channel from your remediation policies:
1
In Slack, enter the channel that you want to remove.
2
Type /semgrep_remove_channel.
3
Select the target organization.
4
Click Remove channel.
Removing a channel takes it out of your list of available channels for remediation policies and stops all remediation policy notifications to that channel.
From the Secrets policies tab, click the three-dot(…) button > Edit policy for the policies that trigger notifications in this channel.
2
Unselect the desired channels from the policy.
3
Click Save changes.
To unsubscribe a channel:
1
In Slack, enter the channel that you want to unsubscribe from Semgrep Secrets findings.
2
Type /semgrep_unsubscribe_secrets.
3
Select the target organization to unsubscribe from.
4
Click Unsubscribe.
Unsubscribing removes this channel from your list of available channels for all Semgrep Secrets policies. You will no longer be able to create policies using this channel, and it will be removed from existing policies, stopping all notifications to this channel.
Notifications are sent only the first time a given finding is detected.When running a diff-aware scan, Semgrep doesn’t notify you when a pull request has a finding that existed on the base branch already, even if that line is moved or re-indented.Semgrep also tracks notifications that have already been sent, so subsequent scans of the same changes in a pull request won’t result in duplicate notifications.
NOTESee Findings in CI for more information about how Semgrep tracks a finding through its lifetime.
To check that your notifications are set up, you can review notifications in two places:
On the Integrations page, locate your Slack integration and expand Channels receiving Semgrep notifications.
In your Slack workspace, click Semgrep under Apps in the Slack sidebar and review the channels under Notifications are being sent to the following channels.
To send a test notification to a channel in this list, click the three-dot menu > Send Test Notification.
If you have set up any filter, such as filtering for a specific policy or project, all conditions of that filter must be present for the notification to be sent. Review your filters by following the steps in Changing Slack notification settings.
You may receive a message from Semgrep Slack app stating that your token does not have up-to-date permissions. Clicking the link provided in the message to update the permissions typically resolves this issue.However, if after updating the token, you still receive the same message, perform the following steps to revoke and refresh your access token:
1
In your Slack workspace, click Semgrep under Apps in the Slack sidebar.
2
Click Uninstall. This revokes your token.
3
Go to Semgrep AppSec Platform > Settings > Integrations.
4
Find the Slack entry for the workspace you revoked in step 2 and click Refresh Token.
5
Follow the steps in the authentication flow to complete the token refresh.
You have refreshed your access token and updated your permissions.
View basic information about private channels that your Slack app has been added to.
Semgrep Slack app uses channels_id_changed to update its notifications configuration if the channel that receives findings is updated. This ensures that you are able to receive findings ever renaming a channel.
View the name, email domain, and icon for workspaces your slack app is connected to.
Semgrep Slack app uses team_name_changed to update its notifications configuration if the team name is updated. This ensures that you are able to receive findings notifications even after renaming your team.
