Slack Schema¶

        graph LR
ST(SlackTeam) -- RESOURCE --> SU(SlackUser)
ST -- RESOURCE --> SB(SlackBot)
ST -- RESOURCE --> SC(SlackChannel)
ST -- RESOURCE --> SG(SlackGroup)
SU -- CREATED --> SC
SU -- MEMBER_OF --> SC
SU -- MEMBER_OF --> SG
SU -- CREATED --> SG
SB -- CREATED --> SC
SB -- MEMBER_OF --> SC
SB -- MEMBER_OF --> SG
SB -- CREATED --> SG
SG -- MEMBER_OF --> SC

SlackTeam¶

Representation of a Slack Workspace.

Ontology Mapping: This node has the extra label Tenant to enable cross-platform queries for organizational tenants across different systems (e.g., GitHubOrganization, AWSAccount, SpaceliftAccount).

Field	Description
firstseen	Timestamp of when a sync job first created this node
lastupdated	Timestamp of the last time the node was updated
id	Slack ID
name	Slack workspace name (eg. Lyft OSS)
domain	Slack workspace slug (eg. lyftoss)
url	Slack workspace full url (eg. https://lyftoss.slack.com)
is_verified	Flag for verified Slack workspace (boolean)
email_domain	Slack workspace email domain (eg. lyft.com)

Relationships¶

A SlackTeam contains SlackUser
```
(SlackTeam)-[RESOURCE]->(SlackUser)
```
A SlackTeam contains SlackBot
```
(SlackTeam)-[RESOURCE]->(SlackBot)
```
A SlackTeam contains SlackChannels
```
(SlackTeam)-[RESOURCE]->(SlackChannel)
```
A SlackTeam contains SlackGroup
```
(SlackTeam)-[RESOURCE]->(SlackGroup)
```

SlackUser¶

Representation of a single User in Slack.

Ontology Mapping: This node has the extra label UserAccount to enable cross-platform queries for user accounts across different systems (e.g., OktaUser, AWSSSOUser, EntraUser).

Field	Description
firstseen	Timestamp of when a sync job first created this node
lastupdated	Timestamp of the last time the node was updated
id	Slack ID
name	Slack username (eg. john.doe)
real_name	User full name (eg. John Doe)
display_name	User displayed name (eg. John D.)
first_name	User first name (eg. John)
last_name	User last name (eg. Doe)
profile_title	User job function (eg. Cybersecurity Manager)
profile_phone	User phone number (eg. +33 6 11 22 33 44)
email	User email (eg. john.doe@evilcorp.com)
deleted	Flag for deleted users (boolean)
is_admin	Flag for admin users (boolean)
is_owner	Flag for Slack Workspace owners (boolean)
is_restricted	Flag for restricted users, aka guests (boolean)
is_ultra_restricted	Flag for ultra restricted users, aka guests (boolean)
is_email_confirmed	Flag for user with confirmed email (boolean)
has_mfa	Flag for users with multi-factor authentication enabled (boolean)
team	Slack team ID

Relationships¶

A SlackTeam contains SlackUser
```
(SlackTeam)-[RESOURCE]->(SlackUser)
```
A SlackChannel is created by a SlackUser
```
(SlackUser)-[:CREATED]->(SlackChannel)
```

A SlackUser is a member of a SlackChannel

(SlackUser)-[:MEMBER_OF]->(:SlackChannel)

A SlackUser is member of a SlackGroup
```
(SlackUser)-[:MEMBER_OF]->(SlackGroup)
```
A SlackGroup is created by a SlackUser
```
(SlackUser)-[CREATED]->(SlackGroup)
```

SlackBot¶

Representation of a bot or app account in Slack. Previously ingested as SlackUser, bot accounts now have their own dedicated node type.

Ontology Mapping: This node has the extra label ThirdPartyApp to enable cross-platform queries for third-party applications across different systems (e.g., GoogleWorkspaceOAuthApp, KeycloakClient, EntraApplication).

Backward Compatibility: This node also carries a deprecated SlackUser extra label so that existing MATCH (n:SlackUser) queries continue to return bots. This label will be removed in v1. Because bots carry the SlackUser label, they may also receive MEMBER_OF and CREATED relationships from channel/group syncs that target :SlackUser nodes.

Field	Description
firstseen	Timestamp of when a sync job first created this node
lastupdated	Timestamp of the last time the node was updated
id	Slack ID
name	Bot name (eg. securitybot)
real_name	Bot display name (eg. Security Bot)
deleted	Flag for deleted bots (boolean)
is_bot	Flag for bot accounts (boolean)
is_app_user	Flag for application user accounts (boolean)

Relationships¶

A SlackTeam contains SlackBot
```
(SlackTeam)-[RESOURCE]->(SlackBot)
```

A SlackBot is a member of a SlackChannel

(SlackBot)-[:MEMBER_OF]->(SlackChannel)

A SlackChannel is created by a SlackBot
```
(SlackBot)-[:CREATED]->(SlackChannel)
```
A SlackBot is a member of a SlackGroup
```
(SlackBot)-[:MEMBER_OF]->(SlackGroup)
```
A SlackGroup is created by a SlackBot
```
(SlackBot)-[:CREATED]->(SlackGroup)
```

SlackChannel¶

Representation of a single Channel in Slack.

Field	Description
firstseen	Timestamp of when a sync job first created this node
lastupdated	Timestamp of the last time the node was updated
id	Slack ID
name	Slack channel name (eg. concern-it)
is_private	Flag for private channels (boolean)
created	Slack channel creation timestamp
is_archived	Flag for archived channels (boolean)
is_general	Flag for users default channels (boolean)
is_shared	Flag for channels shared with other workspaces
is_org_shared	Flag for channel shared with other workspaces in same organization
num_members	Number of members in the channel
topic	Slack channel topic
purpose	Slack channel purpose

Relationships¶

A SlackTeam contains SlackChannel
```
(SlackTeam)-[RESOURCE]->(SlackChannel)
```
A SlackChannel is created by a SlackUser
```
(SlackUser)-[:CREATED]->(SlackChannel)
```

A SlackUser is a member of a SlackChannel

(SlackUser)-[:MEMBER_OF]->(:SlackChannel)

A SlackChannel is created by a SlackBot
```
(SlackBot)-[:CREATED]->(SlackChannel)
```

A SlackBot is a member of a SlackChannel

(SlackBot)-[:MEMBER_OF]->(SlackChannel)

A SlackGroup is member of a SlackChannel

(SlackChannel)<-[MEMBER_OF]-(SlackGroup)

SlackGroup¶

Representation of a single Group in Slack.

Ontology Mapping: This node has the extra label UserGroup to enable cross-platform queries for user groups across different systems (e.g., AWSGroup, EntraGroup, GoogleWorkspaceGroup).

Field	Description
firstseen	Timestamp of when a sync job first created this node
lastupdated	Timestamp of the last time the node was updated
id	Slack ID
name	Slack group name (eg. Security Team)
description	Slack group description
is_subteam	Flag for sub-groups
handle	Slack handle (eg. security-team)
is_external	Flag for external groups
date_create	Slack group creation timestamp
date_update	Slack group last update timestamp
date_delete	Slack group deletion timestamp
updated_by	User ID who has performed last group update
user_count	Number of members
channel_count	Number of channels where group is member

Relationships¶

A SlackTeam contains SlackGroup
```
(SlackTeam)-[RESOURCE]->(SlackGroup)
```
A SlackUser is member of a SlackGroup
```
(SlackUser)-[MEMBER_OF]->(SlackGroup)
```

A SlackGroup is member of a SlackChannel

(SlackChannel)<-[MEMBER_OF]-(SlackGroup)

A SlackGroup is created by a SlackUser
```
(SlackUser)-[CREATED]->(SlackGroup)
```
A SlackBot is member of a SlackGroup
```
(SlackBot)-[MEMBER_OF]->(SlackGroup)
```
A SlackGroup is created by a SlackBot
```
(SlackBot)-[CREATED]->(SlackGroup)
```