Check suspicious domains shared in Slack
Turn a questionable link into a clear threat review before anyone clicks again.
Trigger
Channel Message Received
Triggered when a message is posted in a Slack channel (public, private, or multi-party IM). Does NOT match direct messages.
Action
Suggest Domain Threat
Tool to suggest a fqdn as a potential threat. use after identifying a suspicious domain to verify its threat categorization.
Why this helps
Security concerns get buried in busy channels and nobody remembers to investigate the link.
- Reduces manual copy and paste during incident triage
- Creates a consistent first pass for questionable domains
- Keeps the investigation tied to the original Slack context
Setup
Build it in a few focused steps.
- 1Connect Slackbot and Dnsfilter once in Notis
- 2Create an automation named Slack domain threat check
- 3Tell Notis to extract a suspicious domain from each channel message and request a Dnsfilter threat suggestion
- 4Pick Channel Message Received as the trigger and choose a report channel
- 5Test with one real message containing a domain
Questions about this workflow
Does this block the domain automatically?
No. It requests a threat suggestion so a person can review the result before changing policy.
Can it inspect every Slack message?
It runs only for the Slack channel message trigger you select.
When this happens · Trigger
Do this · Action
Supported Triggers and Actions
Notis builds workflows that link Slackbot to Dnsfilter. A trigger fires from one place; an action lands in another.
Slackbot triggers
Dnsfilter actions
Recurring trigger
Notis starts this workflow on a schedule, such as daily, weekly, or during business hours.
Create IP Address
Tool to create a new ip address in dnsfilter. use after confirming the target network id exists.
Webhook trigger
Notis starts this workflow when an external tool or custom backend sends an HTTP request.
Get Application Category
Tool to get basic information of a specific application category. use when you need details for a given application category id.
New Channel Created Trigger
Triggered when a new channel is created in Slack.
Get Billing Information
Tool to retrieve basic billing information for an organization. use when you need to obtain billing details for reporting or automation tasks.
Channel Message Received
Triggered when a message is posted in a Slack channel (public, private, or multi-party IM). Does NOT match direct messages.
Get Category
Tool to get basic information of a specific category. use when you need to retrieve details for a category by its id.
Direct Message Received
Triggered when a new direct message (DM) is sent to a user in Slack. Catches all DMs across all DM channels.
Get IP Address
Tool to get basic information of the specified ip address. use when you need to fetch metadata for a particular ip after authentication.
Message Reaction Added
Triggered when a reaction is added to a message in Slack. Supports optional filtering by channel and emoji name.
List All Categories
Tool to list all categories including internal categories. use when you need the complete set of filtering categories.
Message Reaction Removed
Triggered when a reaction is removed from a message in Slack. Supports optional filtering by channel and emoji name.
List All IP Addresses
Tool to list all user-associated ip addresses. use when you need a comprehensive list of all ip address entries in your organization.
Reaction Added Trigger
DEPRECATED: use `SLACK_MESSAGE_REACTION_ADDED` instead. Triggered when a reaction is added to a message in Slack.
List All MAC Addresses
Tool to list all mac addresses with basic information. use when you need to retrieve all mac address entries in your organization.
Connect any two apps with Notis in the middle.
Slackbot and Dnsfilter, or any other combination from 1,000+ integrations.
When this happens · Trigger
Do this · Action
Save your first hour today.
7-day trial of any paid plan, with 20$ of usage included.
No card. Works with personal or business Dnsfilter.