MDR in Slack or Teams: How Chat-Native Delivery Works

MDR in Slack or Teams puts a provider's analysts in the channel your team already watches, but that helps only when someone with authority can act on what lands there. With a ticket-based provider, the delay can come after the analyst's finding: the ticket generates an email, and the person who can approve host isolation may not open the queue until morning.

Traditional MDR providers investigate alerts and respond within an agreed scope. AI SOC tools automate triage and investigation, but your team operates them and owns the response. AI-native MDR pairs agentic investigation with human review of ambiguous cases, and the provider carries out agreed response actions with contractual accountability.

In all three, a finding reaches the person who can act on it through a ticket queue, an email-and-phone tree, or a live thread in Slack or Microsoft Teams. Weigh that route when choosing an MDR provider.

TL;DR:

• The communication model sets how many handoffs sit between a finding and action. A ticket waits for someone to open the queue, and a channel post often still needs someone with authority to respond.
• "Works over Slack" covers at least five different capabilities, from a webhook post to in-chat approval. Among the MDR services named here, the options on offer are two-way threads and pre-approved response; in-chat approval buttons show up in automation tools such as Tines.
• Pre-authorization decides whether containment waits for another approval. Without it, the provider still has to reach a person on your side, whatever tool it uses.
• Treat chat as a collaboration layer over a case record. Slack Connect and Teams shared channels handle retention and holds differently. Keep approvals somewhere you retain.

Why the Communication Model Decides How Fast You Act

Every hop between the analyst's verdict and your approver can add a wait, and ticket-based delivery adds several. The analyst writes up the case, and the notification can sit in an inbox until someone on your side opens it, rebuilds what the analyst already knew, and finds the person who can say yes. Stacked overnight, those hops can leave hours between the alert reaching you and the host being contained.

A ticket carries the analyst's summary, but the business context behind it can stay on the provider's side of the queue. Questions from your side, such as whether a user is in that office or whether your team sanctioned a script, go back as ticket comments, and each round trip can restart the clock. Panther built its Slack bot to sync a user's reply back to the alert record, because chasing answers by hand tended to scatter context across side conversations and direct messages.

In Sophos's 2026 incident response and MDR casework, 88.10% of ransomware was deployed during non-business hours. In a Christmas Eve 2022 Trigona intrusion, ransomware ran less than three hours after initial access through a remote desktop connection. Against that window, a provider that notifies and waits is only as fast as your on-call rotation.

The Three Common Communication Models

Each model puts the wait in a different place. Console and ticket is the familiar default: the provider's console is the system of record, notifications arrive by email, and questions go back and forth as ticket comments. The console gives you an audit trail and structured reporting, and closing a case follows a defined process. Any step that needs your input waits until someone opens the queue.

Email and phone escalation layers urgency on top of the queue. Rapid7's MDR sends incident emails at low, medium, and high severity, and a SOC team member calls designated contacts for medium- and high-severity incidents. Microsoft Defender Experts MDR phones listed contacts in break-glass scenarios such as ransomware or data exfiltration. A call reaches a person quickly when someone answers, but it leaves little written record.

Chat-native delivery, sometimes called chat-based MDR, puts the analyst in the channel. Expel's threaded notifications give customers two-way messaging with its SOC in Slack or Teams: a reply in the thread reaches the SOC without a support ticket or a console login, and a bot confirms receipt. Defender Experts posts incidents to a Teams channel and also offers real-time chat in Teams that syncs with the incident's Chat tab in the Defender portal.

These models often combine: a provider can keep the case in its console, discuss it in chat, call for urgent items, and run pre-authorized containment without waiting for a reply in any of them. Here is how they compare on the steps that need your input overnight:

‍

What "Works Over Slack" Can Mean

"Slack integration" on a datasheet tells you little on its own, because vendors use the same words for at least five distinct capabilities. A sixth, running the full case lifecycle in chat, isn't offered by any managed service named here.

Notification-Only Posts

Huntress webhooks route incident notifications to a dedicated Slack channel, where Slack's own alert settings ping whoever is on call. Zscaler MDR, formerly Red Canary, lets customers send a Teams message from an automation playbook when a threat is published. In both setups, the channel works one way, from the provider to you.

Verification Pings to the End User

"Was this you?" is a common chat pattern. Torq describes a suspicious-login playbook that asks the user over Slack, Teams, or email, closes the case on a yes, and escalates and contains on a no or no reply. Intezer's AI analyst contacts the employee or their manager over email or Slack and folds the answer into its decision. James Berthoty, reviewing AI SOC tools for Latio, judged a Slack confirmation for common, usually benign anomalies such as impossible travel the most helpful automation among the tools he tested.

Slack's security team flagged the weakness in 2016 when it described its security alerting bot: asking the user does little good if an attacker controls the account. In the design Slack described, the bot required an ack reply plus a two-factor push to the user's phone, and it escalated to the security team if the message was deleted. A plain yes can add context to an investigation, but it can't prove identity on its own when the account answering may be compromised.

Two-Way Investigation Threads With the SOC

In Expel's setup, the SOC's replies come back into your chat thread, and customers can also create and comment on Zendesk support tickets, with attachments, from Slack or Teams. Ask whether Expel has shipped ticket resolution from chat, which was still planned as of April 2026.

Defender Experts posts each incident that needs your attention to a Managed response channel in a team created in your tenant, but its analysts only see replies to posts they created and can't open files attached in chat. Some replies come from a "Defender Experts virtual assistant" posting on the analysts' behalf.

In-Chat Response Approval

The public examples of in-chat approval buttons come from automation platforms. Tines describes an approval pattern for agents that posts approve, reject, and escalate buttons to a Slack channel and logs the approver and timestamp. CrowdStrike's Falcon Fusion workflows stop short of that: the approver gets a Slack notification with a link to respond and picks Approve, Decline, or Escalate on a response screen. Fusion is a Falcon platform feature, separate from the Falcon Complete managed service. In both cases, the approval step sits in a workflow your team builds and owns.

On the MDR side, the published scope works through pre-approval. Expel sets its auto-remediation scope in a pre-approved playbook that customers can adjust. Defender Experts analysts with the security operator role can take specific remediation actions agreed with your SOC team, while for supported third-party sources they give response guidance and your team acts in the product.

Pre-Authorized Response, With Chat as the Receipt

Expel's contain-host action runs with the customer's pre-approval, and customers decide which hosts the automation can and can't touch. Here, chat can be how you find out it happened.

These five capabilities can coexist in one service. Verification pings, two-way threads, in-chat approval, and pre-authorized response should shorten the time from alert to action, since each removes a round trip or settles the decision in advance. The sources here don't measure that effect, and notification-only posts mostly add volume.

What to Ask a Provider Before You Sign

The answers show whether a provider's channel can carry a decision or only a notification:

• Two-way or notification-only? Ask whether an analyst answers in the channel, or whether a webhook or Azure Logic App posts and nothing comes back.
• Who is typing? Ask which messages come from a named analyst, a bot, or an AI assistant posting for the team.
• Can containment be approved in the channel, and by whom? If yes, ask for the log entry that records the action, the approver, and the timestamp.
• What is pre-authorized and what is escalate-first, in writing? That split decides whether the provider can act at 2 a.m. without waking anyone.
• Where does the investigation record live, and does chat sync back to it? Anything that stays only in chat is evidence you can lose.
• Where is chat content stored, who can read it, and who owns the channel when the contract ends? The contract has to cover what platform controls don't.

A responsive channel to a provider that escalates everything still floods your team. Escalation volume runs higher with some provider types than others, so weigh it alongside the channel.

The Trade-Offs of Chat-Native Delivery

Chat speeds up questions and decisions, but it brings noise, retention gaps, and new access decisions. A Brex security engineer wrote in 2023 that Slack falls short as an alert console because it can't manage or organize alerts or collect metrics from them. A provider that forwards every alert into your channel has moved the queue into a tool that wasn't built to track it, unless the integration syncs replies back to a case record.

Retention rules depend on the platform. In Slack Connect, your retention settings apply only to messages and files your own members send, and only the organization that sent a message can edit or delete it. Slack's legal holds, an Enterprise plan feature, don't cover Slack Connect conversations.

Teams shared channels inherit the parent team's retention policy, every message is discoverable whoever posted it, and admins may hold the whole team, but admins can't place external participants on hold individually. Check the setup your provider actually uses before assuming either platform's gap applies.

Your organization owns Slack Connect channels created in your workspace, and only the owner can invite or remove other organizations or manage posting permissions, so create the channel yourself. Removing the provider when the contract ends is then your call.

If the provider joins a Teams shared channel with external identities, both organizations have to set up Microsoft Entra B2B direct connect and cross-tenant access settings, which brings your identity team into provider onboarding. In an app-based setup, Defender Experts reaches its channel through its Teams app, and you don't add its analysts to the team. A provider's app in your workspace is a separate access decision from inviting its analysts.

How to Choose an MDR Delivery Model

Start with who can authorize response, then weigh how your team works and what evidence you must keep:

• If your approvers aren't formally on call after hours, negotiate pre-authorized response authority before you negotiate the channel. A two-way thread with an analyst who still needs your yes doesn't change the overnight math.
• If you need audit-grade evidence of who approved what, require a case record outside chat, confirm that channel decisions land in it, and set retention on your side. A deleted message can't prove an authorization.
• If your security team is small, distributed, and already lives in Slack or Teams, weight two-way threads and pre-authorized response heavily, and ask whether in-chat approval is on the provider's roadmap. Skipping the queue only helps in a channel people actually watch.
• If you operate under data residency or legal-hold obligations, check each platform's retention and legal-hold rules before investigation detail flows into chat, and decide what stays in the provider's platform.
• If your in-house SOC owns investigation and response and wants chat commands over its own tooling, you're shopping for an AI SOC tool, a separate purchase category. A managed service carries contractual accountability for investigation and response, which an AI SOC tool leaves with your team.

Most teams end up with a mix: chat for questions and decisions, the console for the record, and a phone call as the fallback. The provider questions above show which parts of that mix a given provider supports.

How AI-Native MDR Changes What Reaches the Channel

In AI-native MDR, agents gather business context and work each case, people step in where a case is ambiguous, and the provider answers for the investigation and the agreed response. Capabilities vary by provider. When alerts are resolved before they reach you, the channel can carry decisions with their context attached, and your team has less to triage.

Many Traditional MDR providers built their operations around a ticket queue and analysts working in shifts. Two-way threads from Expel and Defender Experts make that queue easier to reach, and both sync the conversation back to the provider's console or portal, which stays the record.

How Daylight Works in Slack and Teams

Daylight's ChatOps layer shares investigation insights, asks questions, and recommends actions inside the Slack or Microsoft Teams workspace your team already uses. Daylight is a MASS company, meaning it offers managed agentic security services for Security Operations. AI-native MDR is the entry point, and threat hunting and the Agentic Security Data Lake run on the same platform.

ChatOps also asks employees to confirm activity over Slack, Teams, or email and weighs the reply as one input to the investigation, an evolving capability that depends on employees replying. Destructive actions such as isolating a host or disabling an account run within the authority level agreed with your team.

Daylight's Glass Box approach keeps the full record outside the channel, showing each investigation's data sources, steps, and reasoning in its management console, and bi-directional integrations can close resolved alerts in the tools that raised them. Daylight reports that its customers typically see roughly 10 to 15 escalations a month, compared with 150 to 200 with Traditional MDR providers, so what reaches the channel is the short list that needs your judgment. Your own volume depends on the environment, service scope, and what counts as an escalation.

Frequently Asked Questions About MDR in Slack and Teams

Will a Slack Approval Satisfy a SOC 2 or ISO 27001 Auditor?

It can, if it shows the control working. Map containment approvals to your incident response controls, such as SOC 2 CC7.4 or ISO 27001:2022 Annex A 5.26. For a sample of incidents, be ready to show that the approver had authority under your documented response procedure and that the action matched what was approved. Agree the evidence format with your auditor before the audit period starts.

What Happens to the Channel History When the MDR Contract Ends?

Unless the contract says otherwise, it follows each platform's retention rules. Write in an export or freeze clause: a notice period long enough to run the export, a full export in JSON or another machine-readable format, and a commitment that the provider won't delete its posts during that window. Name who removes the provider's app and disconnects the channel on the last day, so access ends when the service does.

What Permissions Should the Provider's Slack or Teams App Get?

Scope the app to the shared channel and avoid workspace-wide read access. Authorize any commands by named user or role; channel membership alone shouldn't grant them. Treat the app's token as a machine identity: record its owner, review its scopes on the same cycle as your other service accounts, and rotate it if the provider's staff changes.

What Response Times Should We Write Into the Contract for the Channel?

Set an in-channel acknowledgment time for each severity. Then write the fallback order for an unanswered channel, such as channel, then page, then phone, and name who owns each step on each side.

How Do We Test the Channel During a Proof of Concept?

Stage an after-hours test with a benign alert that needs a decision. Time how long the provider takes to post, how long your approver takes to answer, and whether the decision lands in the case record. Then leave one thread unanswered and check that the provider follows the fallback order in the contract.