Slack
Slack workspace / Enterprise Grid discovery for the M&A Discovery Suite.
What it does
Enumerates the Slack workspace, its users, and its channels via the Slack Web API (https://slack.com/api/), surfacing the M&A IT/security due-diligence signals that matter on a tenant: external/guest accounts, two-factor-auth posture, admin/owner sprawl, bot/app (service) accounts, deactivated users, externally-shared channels (data-leakage exposure), and private-channel count. Endpoints used (all documented Slack Web API methods; Bearer token auth): auth.test - validate the token, detect Enterprise Grid (probe) (any token) team.info - workspace id/name/domain/email_domain/enterprise (team:read) users.list - paged member list, cursor pagination (users:read, users:read.email) conversations.list - paged channel list, cursor pagination (channels:read, groups:read) Auth: a single Slack token in $Configuration.SlackToken (bot xoxb- or user xoxp-/admin token). NO interactive login - the token is supplied by the Credentials Manager via DISCOVERY_CREDENTIAL_MAP ('slack' - SlackToken). Output (static-name CSVs in $Context.Paths.RawDataOutput, registry contract): SlackWorkspace.csv - 1 row: the workspace / enterprise. SlackUsers.csv - 1 row per member, with a derived AccountType. SlackChannels.csv - 1 row per channel, with derived Visibility/ExternalSharing. Honesty (cardinal rule): NO fabrication. A missing token - honest skip + warning. An API error - recorded as a warning, never a fake row. Counts are real. TestOnly mode: set $Configuration.TestOnly = $true to run only auth.test and return (a credential/connectivity probe) without enumerating users/channels. Enrichment: ConvertFrom-SlackUser is a pure function that transforms Slack API user objects into discovery records with enriched properties (IsAdmin, IsBot, TimeZone, IsDeleted, RealName, AccountType, etc).
How the app exposes it
The module runs through the ACQI discovery orchestrator and writes its rows into a dedicated results view. From there, conflicts, dependencies, and readiness scores feed the deal-wide consolidation layer.
/discovered/slack Outputs
Each module emits a normalised CSV keyed by entity ID with readiness and risk scores, evidence-source counts, and last-seen timestamps. The exact column set varies by module — the app's results view shows the live schema.