Slack

Connect Slack to work on findings without leaving your channels. Once it is connected, you can:

• Ask @Odin about findings, assets and assessments, and ask for a security briefing.
• Triage from Slack: assign findings, move them through their workflow, link pull requests and post comments, each confirmed on an approval card.
• Link a thread to a finding, so the conversation shows up in the finding’s discussion in Odin and replies flow both ways.
• Get notified in a channel when findings are reported, retests fail or findings are assigned.

​

Connecting Slack

Owners, Admins and Members can connect Slack. Viewers can see the integration but not change it. See Roles & Permissions. For a private channel, invite Odin first by typing /invite @Odin in the channel. Public channels work straight away. To use a different default channel later, select Change next to Default Channel on the Slack card. Odin posts its welcome message in the new channel.

​

Re-authorising

When a new feature needs extra Slack permissions, the Slack card shows Re-authorisation required. Select Re-authorise Slack and approve the new permissions in Slack. Your default channel, channel overrides and linked accounts stay as they are, and Odin does not post the welcome message again.

​

Who can use @Odin

You need a current Odin account in the connected organisation. Odin maps your Slack identity to that account and applies your role, the organisation’s portal access, trial rules and the relevant product access. Slack workspace membership alone does not grant access to Odin data. Odin recognises you when your Slack account is linked to your Odin account. If it isn’t linked yet, Odin offers you a private Connect account button. Anyone without an Odin account, including guests from other workspaces, gets a short reply saying they need one. Viewers can ask questions. Changes, such as assigning findings, triage and linking or unlinking threads, need the Owner, Admin or Member role.

​

What Odin shows where

Everyone in a channel can read Odin’s replies, including people without an Odin account or with a lower role than yours. So how much Odin shows depends on where you ask: In a channel, ask for a finding’s description, technical details or remediation and Odin sends them to you in a message only you can see. Open details on a finding card does the same. Messages only you can see disappear when Slack reloads, so open the finding in Odin to keep them to hand. Some things are only available in a direct message with Odin: a finding’s full discussion, exports, and download links for discussion attachments. In a channel shared with another organisation, Odin can’t make changes or sync threads. Ask in a direct message or use Odin instead. If Odin can’t confirm how a channel is shared, it treats the channel as shared with another organisation.

​

Asking @Odin

Invite Odin to the channel where you want to ask questions, then mention @Odin. It replies in the message’s thread, and when you mention it inside a thread it reads the earlier messages for context. Try:

• @Odin what's open and critical?
• @Odin show me the details of ACME-17
• @Odin assign ACME-17 to me
• @Odin link this thread to ACME-17
• @Odin what changed since Monday?
• @Odin list our subdomains

Replace ACME with your organisation’s finding prefix. The Try it in Slack section on the Slack card shows examples with your own prefix, ready to copy. @Odin only reads and changes your own organisation’s data. It does not change a finding’s severity, launch tests or answer questions unrelated to Odin.

​

Messaging Odin directly

You can also ask Odin privately. Open Odin under Apps in Slack and write in the Messages tab, or open Odin from Slack’s AI assistant panel, which suggests a few questions to start with. Odin uses the same access rules as for a mention, and because only you read the reply, it shows everything your role can see. Once your Slack account is linked, the Home tab shows up to 10 open findings assigned to you, with links to Odin and your notification settings. If your workspace connected Slack before this was available, an Owner, Admin or Member needs to re-authorise Slack before Odin can read direct messages.

​

Investigate a finding

Ask questions such as:

• “Which High findings are assigned to me?”
• “Show findings from owner/repository.”
• “Why is BORG-42 still open?”

In a direct message, finding details include recorded remediation guidance, linked pull requests, the latest available retest verdict, recent discussion messages and workflow blockers. In a channel, Odin shows less; see What Odin shows where. Discussion and retest history are bounded; Odin reports when there is more history or when the feature is unavailable. Owners, Admins and Members can also ask Odin to:

• Read a finding’s full discussion, or compare discussion and retest activity across several findings.
• Find accessible pull requests to link to a finding.
• List the repositories and assets your findings reference, or show one asset’s details.
• Export the findings matching a filter.
• Open a synced discussion in Slack, or give a download link for a discussion attachment.

Full discussions, exports and download links are only available in a direct message with Odin. These use the same access checks as Odin and the Odin MCP server, applied to your current role. Searches return a page and continuation information. Ticket totals are exact, but the shared list can cap engine findings. Treat a stated lower bound as a minimum, and ask Odin to continue when more pages remain. An unresolved assignee identity is different from an unassigned finding.

​

Triage without leaving the conversation

Members and above can ask Odin to:

• Assign or unassign a finding, where Slack assignment is enabled.
• Move a finding through a permitted client status transition.
• Link an existing GitHub pull request that the organisation’s GitHub connection can access.
• Post a confirmed comment in the finding’s native discussion.
• Edit or delete your own discussion messages.
• Resolve or reopen a finding’s discussion. This does not change the finding’s status.
• Remove a pull request you linked manually. The pull request itself is not changed.

For example, ask “Move BORG-42 to Fixing”, or “Link https://github.com/owner/repository/pull/42 to BORG-42”. Odin posts an approval card showing the exact proposed change. Only the person who requested it can click Approve; typing “yes” does not approve a write. Linking a PR to a Reported finding also moves it to Fixing, just as in Odin. Before accepting risk, provide a reason and review the warning that the finding leaves the default list. Before posting a comment, review its exact wording and destination on the approval card. Approvals expire after ten minutes and can be used only once, for the displayed parameters in that channel and thread. Cancel discards the proposal. A native comment does not activate Slack thread syncing or copy the rest of the conversation. If the finding’s status changes before you approve a status change, Odin refuses the old proposal. Request a new change using the current status. Open for Retest records readiness for verification; it does not launch a retest. Fixed & Retested remains a Borg-controlled result. These actions do not create PRs, run repairs, launch assessments or spend scan credits. If a comment attempt has an uncertain outcome, check its discussion in Odin before asking to post again. Odin prevents a second comment attempt for the same finding in one inbound request. A saved change can succeed even if a downstream notification fails; the reply distinguishes those outcomes.

​

Ask for a security briefing

Ask “What changed since Monday?” and give the intended date and timezone if needed. A briefing covers an explicit interval of at most 31 days and separates recorded activity during that interval from current actions:

• Newly reported findings and recorded status, assignment, PR, discussion or retest activity.
• Current unresolved Critical and High findings.
• Current open findings without an owner.
• Recorded failed or incomplete retest results during the interval, where available.
• Open linked remediation PRs to check. An open PR alone does not establish whether it needs approval.

A briefing examines at most 250 visible findings. Section counts are lower bounds and examples are limited. Revision-only edits without a supported activity timestamp are not classified as changes. Current open findings describe the state when the briefing runs, even when you ask about an earlier interval. The existing weekly Slack summary also includes bounded action counts and finding links when available. It keeps the existing delivery audience and schedule. The action briefing covers at most the most recent 31 days if an older digest watermark needs catching up.

​

Check assessments and coverage

Ask “Is our pentest finished?” or “What coverage was recorded for this run?” Odin can list accessible standard AI pentest runs and show their recorded status, phase, report page and endpoint coverage.

• Tested, Blocked and Untested mean those states were explicitly recorded.
• Missing or unknown coverage stays unknown; it is not counted as untested.
• Coverage describes discovered endpoints in the recorded snapshot, not proof that every application endpoint was found.
• Internal error text, agent logs, unrecorded blocker reasons and estimated completion times are not exposed.

Reports link to the authenticated run page. Micro Pentest trial runs use their own Odin journey and are not listed as standard assessments here. You can also ask “Which assets have CAD explicitly disabled?” or ask for assets matching a run’s recorded target hosts. An absent CAD setting is unknown. Matching a target host shows a scope relation; it does not prove the asset was tested. Filtered asset searches examine at most 250 source records per call and return continuation information when more records remain.

​

Finding cards and thread sync

Type a finding ID such as ACME-17 in a channel Odin is in, and Odin replies in the thread with the finding’s card: its title, a short summary, status, severity and assignee. In a channel shared with another organisation, the card shows only the ID, severity and status. Open details shows the rest to you alone. The card’s menu has two options:

• Sync with Odin links the thread to the finding. It isn’t offered in channels shared with another organisation.
• View in Odin opens the finding.

Pasting a link to a finding can also show a preview of it, following the same rules. In a direct message between people, Odin can’t see who is in the conversation, so the preview shows only the ID, severity and status. You can also ask @Odin link this thread to ACME-17; @Odin asks you to confirm first.

​

How a synced thread works

Once a thread is linked to a finding, the sync is two-way:

• Replies in the Slack thread appear in the finding’s discussion in Odin, under Slack thread connected in #channel. Images come across too.
• Replies you write in that part of the discussion in Odin are posted to the Slack thread, marked via Odin.

Replies from Slack are attributed to the Odin member whose Slack account is linked. Borg operators working on your findings can see messages in a synced thread. To stop syncing, ask @Odin stop syncing this thread. Messages already in Odin stay there, and new Slack replies no longer appear.

​

Notifications

Odin posts these to your default channel:

• New findings
• Retest failures
• Finding assignments
• A weekly summary

Notifications show a finding’s short summary, not its description. Use Channel overrides on the Slack card to send a notification type to a different channel, for example finding assignments to a team channel. Types without an override use the default channel. See Alert Centre for how Slack fits with in-app and email notifications.

​

Linking your Slack account

You need a linked Slack account to ask @Odin questions. Odin links it automatically when the email address verified in Slack matches your Odin email, or when you connected the workspace. Otherwise, open the Slack section of your profile:

• If Odin found a likely match, select Confirm if it’s you, or Not me if it isn’t.
• To link it yourself, select Connect Slack and approve in Slack. The same option appears on the Slack card under Management > Integrations.

If you mention @Odin before linking, Odin replies with a message only you can see and a Connect account button. Once you’ve linked, you’re taken back to Slack and Odin answers your question in the thread. You can Unlink a linked account from your profile at any time. Owners and Admins can see who has linked, and remind those who haven’t, under Members connected on the Slack card. See Who has connected. Owners and Admins can also link Slack accounts to Odin members under User mapping on the Slack card. This helps when someone uses a different email address in Slack.