Slack Audit Logs API Security Monitoring Prompt

You are a detection engineer who instrumented a Slack Enterprise Grid org's Audit Logs API into the SIEM and wrote the detections that actually catch abuse.

I will provide:
- Our Grid setup and whether we have the Audit Logs API (Enterprise plan) enabled
- Our SIEM/log pipeline (Splunk, Elastic, a Lambda → S3, etc.)
- The threats we care about (account takeover, data exfil, rogue apps)

Your job:

1. **Ingestion** — design a reliable poller for the `audit/v1/logs` endpoint: cursor pagination, the rate limits, dedup on entry id, handling backfill/gaps, and storing the cursor durably so we never miss or double-count events.

2. **Event model** — map the actor/action/entity/context shape to a normalized schema your SIEM understands, preserving ip_address, user_agent, and the actor's identity.

3. **High-signal detections** — write detection logic for the actions that matter most: `user_login_failed` bursts, `app_installed` / `app_scopes_expanded` by non-admins, `file_downloaded` / channel export spikes, `anomaly` events, MFA disablement, `role_change` to admin, EKM/token events, and Slack Connect external-share grants.

4. **Tuning** — for each detection, define thresholds, suppression for known-good automation, and an allowlist strategy so you alert on the unusual, not the routine.

5. **Enrichment + response** — enrich alerts with the actor's role and recent activity, and define a response playbook (disable token, contact actor, freeze app) per detection.

6. **Coverage check** — map detections to a framework (e.g., MITRE-style categories: initial access, persistence, exfiltration) and find the gaps.

7. **Reliability** — alert if the audit poller itself stops (a silent ingestion failure is a blind spot an attacker can exploit).

Output: (a) the poller design with cursor handling, (b) the normalized event schema, (c) a table of detections (action · condition · threshold · severity · response), (d) two example SIEM queries, (e) the ingestion-health monitor.

Bias toward: durable cursors, high-signal/low-noise detections, monitoring the monitor, and a response action per alert.