Skip to main content
Chat operations (ChatOps) are how Wirespeed confirms suspicious activity with users from your company. We message them over your collaboration platforms and ask whether they performed the activity. Chat Ops is off for new customer accounts. Service provider accounts always have Chat Ops on. Turn on Enable Chat Ops at the top of Settings > Chat Ops once your channels and message templates are ready; while it is off, verdict rules apply their outcome without messaging users.

​
How Chat Ops Works

Chat Ops is an add-on for Escalate verdict rules. Correlate & Resolve, Skip, and Run Monitors rules cannot use it. Containment can run on the same rule. When a detection matches an Escalate rule with Chat Ops on:
  1. Wirespeed applies the verdict first: containment runs, then the detection is escalated to your team.
  2. Wirespeed then messages the involved users. It does not wait for a reply before escalating.
Wirespeed’s default verdict rules leave Chat Ops off, except the Account Compromise rule that asks the user to confirm the activity when the matching managed rule has not met its review threshold. Every other prompt comes from your own rules set to Escalate with Chat Ops on. See Verdicts.

​
Responses

Silence never changes the verdict. A reply changes the outcome only while the reply window is open, the detection is unresolved, and neither a person on your team nor an API key has changed its verdict or status. Otherwise, a reply is recorded as a highlighted timeline entry and the outcome stays in place: nothing is released, and No, this wasn’t me does not trigger containment. Response links stay valid for 30 days so late answers still reach your security team.

​
Reply Window

The reply window is how long Wirespeed waits for a reply before marking the prompt unanswered. By default it is 2 days, and it can be set from 1 minute to 7 days. It does not delay escalation or change the outcome. While a prompt is open, new detections in the same case reuse it instead of messaging the user again. You can modify the reply window under Settings > Chat Ops.

​
Security Team Notifications

Security team alerts are delivered through standard notifications and team inbox email escalations instead of a chat ops conversation. Configure:
  • user notification subscriptions in your profile (Notifications)
  • team escalation inboxes under Settings > Team

​
Multi-factor Verification

After a chat ops message is sent you can optionally require the user to verify their identity over SMS. This helps protect your organization in cases where the user’s account has already been compromised. When this setting is enabled, the user will be texted an SMS code to verify their identity after they respond to our chat ops message. If no mobile phone number is identified for the user, their response cannot be verified, so Wirespeed discards it and leaves the detection escalated.

​
FAQ

The detection was already escalated before the message was sent. If the user doesn’t respond within the reply window (default: 2 days), Wirespeed marks the prompt unanswered and leaves the outcome in place. A later reply is recorded on the timeline for your security team but does not change the outcome.
Yes. Navigate to Settings > Chat Ops to modify the reply window. The reply window only controls when a prompt is marked unanswered; it never delays escalation or changes the verdict.
Only rules set to Escalate. Correlate & Resolve, Skip, and Run Monitors rules cannot use Chat Ops. Containment actions can run on the same rule and always run before the user is messaged.
Wirespeed can send chat ops messages via Email, Slack, Microsoft Teams, and SMS. We initially message users through all available communication channels to maximize response rates.
If SMS MFA verification is enabled, users must verify their identity with a code sent to their phone after responding to a chat ops message. This helps ensure a compromised account cannot falsely claim activity is legitimate. If no phone number is available, the unverified response is discarded and the detection stays escalated.