# Suricata Slack alert

**URL:** <https://forum.suricata.io/t/suricata-slack-alert/1352>\
**Category:** Help\
**Tags:** centos\
**Created:** [May 6, 2021, 6:23am UTC](https://forum.suricata.io/t/suricata-slack-alert/1352 "2021-05-06T06:23:54Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![mstrbgn](https://avatars.discourse-cdn.com/v4/letter/m/f17d59/32.png) [@mstrbgn](https://forum.suricata.io/u/mstrbgn)\
**Post date:** [May 6, 2021, 6:23am UTC](https://forum.suricata.io/t/suricata-slack-alert/1352/1 "2021-05-06T06:23:54Z")

</div>

how can we send suricata alert to the slack channel

---

<div class="post-metadata">

**Author:** ![Jeff\_Lucovsky](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.suricata.io/jeff_lucovsky/32/11_2.png) [@Jeff\_Lucovsky](https://forum.suricata.io/u/Jeff_Lucovsky)\
**Post date:** [May 6, 2021, 11:48am UTC](https://forum.suricata.io/t/suricata-slack-alert/1352/2 "2021-05-06T11:48:07Z")

</div>

Perhaps via a “watcher” mechanism that detects when new alerts are logged to the output type configured for `eve-log` is one way to solve the problem. The watcher can gather the Suricata alert(s) and communicate with the Slack interconnect.

---

<div class="post-metadata">

**Author:** ![mstrbgn](https://avatars.discourse-cdn.com/v4/letter/m/f17d59/32.png) [@mstrbgn](https://forum.suricata.io/u/mstrbgn)\
**Post date:** [May 7, 2021, 5:04am UTC](https://forum.suricata.io/t/suricata-slack-alert/1352/3 "2021-05-07T05:04:49Z")

</div>

Thanks a lot for reply, But the Watcher is a licensed feature. Can u please suggest anythings else which is third party free and opensource.

---

<div class="post-metadata">

**Author:** ![ish](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.suricata.io/ish/32/8_2.png) [@ish](https://forum.suricata.io/u/ish)\
**Post date:** [May 7, 2021, 3:33pm UTC](https://forum.suricata.io/t/suricata-slack-alert/1352/4 "2021-05-07T15:33:04Z")

</div>

I think Jeff is referring to just some generic “watcher” tool, not a specific licensed one (I’m taking a guess you might be referring the Elastic’s Slack integration in their x-pack).

Suricata has no integration with Slack itself, so you’ll need some tool to watch the logs and forward those to Slack.