How to Set Up Slack Alerts for Your UniFi Network

Slack is where your team already communicates, so it’s the natural place to receive security alerts. In this guide, we’ll walk through setting up Slack integration with Sentinel Nerd, from basic notifications to advanced severity routing with threaded follow-ups.

Why Slack for Security Alerts

Email is where alerts go to die. They pile up, get filtered, and lose urgency. Slack gives you:

• Instant visibility — Alerts appear in channels your team is already watching
• Collaborative response — Discuss incidents in threads without switching tools
• Mobile push notifications — Get critical alerts on your phone immediately
• Searchable history — Find past alerts and discussions quickly
• Bot integrations — Combine with other tools for automated workflows

Prerequisites

Before you start, you’ll need:

• A Sentinel Nerd account on any plan (Starter, Pro, or Enterprise)
• Admin access to your Slack workspace
• At least one UniFi controller connected to Sentinel Nerd

Step 1: Create a Slack Webhook

First, create an incoming webhook in your Slack workspace:

1. Go to api.slack.com/apps and click Create New App
2. Choose From scratch and name it “Sentinel Nerd Alerts”
3. Select your workspace and click Create App
4. In the left sidebar, click Incoming Webhooks
5. Toggle Activate Incoming Webhooks to On
6. Click Add New Webhook to Workspace
7. Select the channel where you want alerts (we recommend #security-alerts)
8. Click Allow
9. Copy the webhook URL — you’ll need it in the next step

The webhook URL looks like https://hooks.slack.com/services/T00000000/B00000000/XXXXXXXXXXXXXXXXXXXXXXXX. Keep it private — anyone with this URL can post to your channel.

Step 2: Add the Webhook to Sentinel Nerd

Now, configure Sentinel Nerd to send alerts to Slack:

1. Log into your Sentinel Nerd dashboard
2. Navigate to Settings > Integrations > Alert Channels
3. Click Add Channel and select Slack
4. Paste your webhook URL
5. Give the channel a name (e.g., “Security Alerts - General”)
6. Select which severity levels should trigger alerts in this channel
7. Click Test to send a test message
8. Click Save

If the test message appears in your Slack channel, you’re connected.

Step 3: Configure Severity Routing

Not every alert deserves the same attention. We recommend creating multiple Slack channels with different severity routing:

Recommended Channel Setup

Channel	Severity	Notification
#security-critical	Critical only	@channel mention
#security-alerts	High + Critical	Normal notification
#security-all	All severities	No notification (muted)

To set this up:

1. Create three channels in Slack
2. Create three webhooks (one per channel)
3. Add each webhook to Sentinel Nerd with the appropriate severity filter

This way, critical alerts interrupt immediately, high-severity alerts are visible but not disruptive, and you have a complete log in the muted channel for review.

Step 4: Customize Message Formatting

Sentinel Nerd sends rich Slack messages with:

• Color-coded sidebar — Red for critical, orange for high, yellow for medium, blue for low
• Alert title with severity badge
• Source and destination IP addresses with GeoIP data
• Detection rule that triggered the alert
• Quick action buttons — View in dashboard, analyze with AI, mark as resolved

You can customize the message template in Settings > Integrations > Slack > Message Format. Available template variables include:

{{alert.title}}
{{alert.severity}}
{{alert.source_ip}}
{{alert.destination_ip}}
{{alert.rule_name}}
{{alert.timestamp}}
{{alert.device_name}}
{{alert.category}}
{{alert.geo.country}}
{{alert.geo.city}}

Best Practices

Separate Channels by Severity

As outlined above, route different severity levels to different channels. This prevents alert fatigue from drowning out critical events.

Set Up Channel-Specific Notification Preferences

In Slack, right-click each security channel and configure notifications:

• #security-critical — Notify for every message, even on mobile
• #security-alerts — Desktop notifications only
• #security-all — Mute the channel, review periodically

Use Threads for Investigation

When a critical alert comes in, start a thread. Post your investigation notes, screenshots from the dashboard, and resolution steps. This creates a searchable incident record.

Create a Triage Workflow

Define a process for your team:

1. Alert arrives in #security-critical
2. First responder reacts with 👀 (eyes emoji) to claim it
3. Investigation notes go in the thread
4. Resolution documented with ✅ (checkmark) reaction
5. Post-incident review if needed

Don’t Alert on Everything

It’s tempting to send every event to Slack. Don’t. Start with critical and high severity, then add more specific alerts as you learn your baseline. Too many alerts leads to everyone ignoring the channel.

Testing Your Setup

After configuration, verify everything works:

1. In Sentinel Nerd, go to Settings > Integrations > Slack
2. Click Send Test Alert for each configured channel
3. Verify the message appears in the correct Slack channel
4. Check that the format, severity color, and content look correct
5. Click a quick action button to confirm links work

You can also trigger a real alert by creating a test detection rule that matches on a common event in your network.

Advanced: Threaded Follow-Ups

On Pro and Enterprise plans, Sentinel Nerd can automatically post follow-up information as thread replies to the original alert:

• AI analysis results — When AI analysis completes, the summary posts as a thread reply
• Threat intelligence updates — If the source IP’s reputation changes, you get an update
• Correlated events — Related alerts from other sources appear in the same thread
• Resolution status — When an alert is resolved in the dashboard, the thread gets updated

Enable threaded follow-ups in Settings > Integrations > Slack > Advanced > Threaded Updates.

Troubleshooting

Messages not appearing? Check that the webhook URL is correct and the Slack app hasn’t been removed from the channel.

Wrong channel? Each webhook is tied to a specific channel. Create a new webhook for a different channel.

Rate limited? Slack limits incoming webhooks to 1 message per second. If you’re generating more alerts than that, consider increasing your detection rule thresholds or using the digest mode in Sentinel Nerd.

Test works but real alerts don’t? Check your severity filter settings. You might have the filter set to a severity level that doesn’t match your actual alerts.

---

Slack integration turns Sentinel Nerd from a security tool into a collaborative security platform. Your team sees threats in real time, discusses response in threads, and builds a searchable knowledge base of past incidents.

Need help with setup? Reach out to support@sentinelnerd.com or check our Slack integration docs.