Understanding API logs for Slack application

Slack is logged similar to every other cloud application with one additional field in the details.

Slack will log the user who a file is shared with but will also log a Slack channel and team that a file is shared in. Slack channels are dynamic and updated in real time when viewing the details.

• In the event logs, under the details column you will notice an extra tag Shared with indicating the slack channel the file is shared with.
  
  
  
  Note:

  • When a file is externally shared, the Shared With field does not list the Email Ids of the external users as Slack does not send the email addresses of external and stranger users for privacy reasons.
  • When sharing a file to an external user through direct messaging, Forcepoint ONE SSE is unable to find the file's sharing status as external due to Slack's privacy policy of not disclosing Channel IDs for such interactions. Consequently, without the Channel ID, Forcepoint ONE SSE can only identify the sharing status if the file is shared publicly.
• In the Details dialog, scroll to the Shared With row and select the people icon next to the Slack channel name to view the users who belong to the channel.
  Note: The channel is updated in real time and will change if users join or leave the Slack channel.

  You can select Show All to view the full list of users.