What data type/kind does Chronicle store?

Here is an overview of the data we store and how we use it:

Team and User Data

When authenticating the app through Slack, we fetch and store the Team and User data. This includes the authentication tokens we use to query Slack's API, the team name, logo and url. The user data is stored in order to calculate the number of users for billing purposes and to populate event data (more on that below).

Channel Data

In order to properly scan channels for inactivity, we store the channel ID and the information returned by the Slack's channels.list endpoint. This does not include message information.

File Data

To power our file monitoring, we store a few fields about files shared within Slack:

• fileId
• name
• title
• user
• isExternal
• isPublic

Message and Event Data

Whenever we detect a match to any of the events you have configured to be monitored by our application, we store a record of the event, but we do not store the full matched messages. This is the template used for message-level events:

• "Found <LINK_TO_MESSAGE> containing 'TARGET_TEXT' with the '<LINK_TO_RULE>' rule."

So if you created a monitor to be alerted if the text coffee mug is shared you we would store something along the lines of:

• "Found <https://your-slack-subdomain.slack.com/archives/CHANNEL_ID/MESSAGE_ID|message> containing 'coffee mug' with the '<https://www.chronicle-app.com/dashboard/messages|Coffee> rule."

The template varies slightly for other types of monitors, such as file, emoji, user, and guest, but the only additional data saved in other instances is the username and ID of the Slack User performing the action.

• "<LINK_TO_SLACK_CHANNEL> was archived by <LINK_TO_SLACK_USER>."