Hog3 Assist in Slack
Mention @Hog3 Assist in the Slack channel you share with Hog3 to ask about your security engagement. Check what’s still open, get fix guidance, update remediation status, re-test a fix, or see whether a new CVE relates to what we found.
Hog3 Assist answers in a thread, using your engagement’s findings, remediation history and public vulnerability databases. It links each answer to the evidence. Status changes and re-tests run only after you approve them.
@Hog3 Assist what’s still open at high or above, and which should we do first?
👀 1
Two findings are open at high or above. Start with F3: the admin API accepts unsigned tokens, so anyone can act as an administrator, and it chains into F5.
Hog3 Assist can make mistakes — check the linked evidence.
Illustrative example; finding details are abbreviated.
What you can ask
| Task | Example | Notes |
|---|---|---|
| Engagement overview | “Summarise the engagement for our CTO.” | Scope, main risks, severity counts and remediation progress. |
| Finding questions | “How many criticals are still open?” · “Explain F7 to a frontend engineer.” | Returns counts, explanations or finding cards. |
| Fix guidance | “How should we fix F12 in our Nginx config?” | Builds on the remediation in your report. |
| Status updates | “Mark F4 in progress — Sam owns it.” | Needs your approval. Any connected member. |
| Re-tests | “We shipped the fix for F11, re-test it.” | Runs a safe, read-only check. Needs approval. |
| Vulnerability checks | “Does CVE-2025-29927 relate to anything you found?” | Uses OSV.dev, FIRST EPSS and CISA KEV. |
| Security questions | “What should we check before launching file uploads?” | General guidance, grounded in your engagement where relevant. |
| Talk to Hog3 | “Can Hog3 re-test F9 manually?” · “We want to add the mobile app to scope.” | Hog3 Assist notifies the Hog3 team. |
Getting started
Hog3 Assist is included with every Hog3 engagement. It runs in a Slack Connect channel shared between your workspace and Hog3, so you don’t need to install an app in your own workspace.
- Accept the shared channel. Hog3 invites your workspace to a Slack Connect channel for your engagement. A Slack admin on your side accepts the invitation.
- Hog3 connects the channel to your engagement. Your Hog3 contact links the channel to your findings and allows the workspaces in it. Hog3 Assist confirms this in the channel.
- Invite your team. Add the engineers and security owners who should use it. Anyone from a connected workspace can ask.
- Mention @Hog3 Assist. Ask your first question in the channel. Hog3 Assist replies in a thread.
Conversations & threads
- Mention @Hog3 Assist in a top-level message or inside any thread. It replies in that thread.
- If you started the conversation, you can keep replying in the thread without mentioning it. Teammates who join the thread mention @Hog3 Assist to ask it something.
- Hog3 Assist reads the whole thread, so follow-ups like “and the highs?” work.
What you’ll see
| Indicator | Meaning |
|---|---|
| 👀 reaction | Hog3 Assist has received your message. |
| Progress message | Shows what it’s checking (“Searching findings”, “Checking vulnerability databases”). The answer replaces it. |
| Finding cards | Severity, status and buttons for Update status, Re-test fix and Open in report. |
| Approval cards | Approve / Cancel buttons for changes Hog3 Assist proposes. |
Findings & remediation status
Each finding has a remediation status. Hog3 tracks it separately from the evidence in your report.
| Status | Meaning |
|---|---|
| Open | The default for every finding. |
| In progress | Your team is working on it. |
| Fixed — awaiting re-test | You’ve shipped a fix that hasn’t been re-tested yet. |
| Fixed — verified by re-test | Set only by a passing Hog3 re-test. |
| Risk accepted | You’ve decided not to fix it. Add a comment explaining why. |
| False positive | You believe the finding doesn’t apply. Hog3 reviews these. |
To change a status, click Update status on a finding card, choose the status, add an optional comment and save. You can also ask in the thread, for example “Mark F4 as risk accepted: legacy admin, decommissioned in Q1.” Hog3 Assist then posts an approval card.
Re-testing fixes
Many findings include an automated check: a safe, read-only request that shows whether the issue still reproduces. Click Re-test fix on a finding card, or ask “re-test F11 and F12”.
- Request. Use the card button, or ask in the thread.
- Approve. Confirm the dialog or click Start re-test on the approval card.
- Results. Hog3 runs the check against your live system and posts the result in the thread, usually within a minute.
| Result | What happens |
|---|---|
| ✅ Fixed | The check no longer reproduces the issue. The status becomes Fixed — verified by re-test. |
| ❌ Still reproducible | The issue reproduced at the time of the check. A finding marked fixed returns to In progress. |
| ⚠️ Manual re-test needed | The finding has no safe automated check, or the check couldn’t complete. Ask Hog3 Assist to escalate it to the Hog3 team. |
You can re-test each finding once every 10 minutes. Re-tests never change your systems.
Vulnerability checks
Paste a CVE or GHSA identifier, or a package and version, for example next 14.1.0 on npm. Hog3 Assist returns:
- the advisory summary, severity and affected and fixed version ranges (from OSV.dev)
- its exploitation likelihood (FIRST EPSS) and whether it’s on CISA’s Known Exploited Vulnerabilities list
- findings from your engagement that involve the same software or advisory
Approvals
Hog3 Assist never changes anything on its own. Status updates, comments and re-tests need an explicit click.
| Action | Who can approve |
|---|---|
| Change a finding’s status or add a comment | The requester, or the Hog3 team |
| Re-test findings | The requester, or the Hog3 team |
| Connect or disconnect the channel | Hog3 team only |
Each approval card shows exactly what will change. Once approved or cancelled, it records who decided and the result.
Limits
- Each thread has a reply limit. When you reach it, start a new thread.
- Conversations close after a week of inactivity.
- Each channel has a daily answer limit to keep usage fair.
- Hog3 Assist doesn’t read your source code, repositories or other systems. It works from your engagement, its own remediation history and public advisories.
- Proof-of-concept code and captured credentials stay in your access-controlled report. Hog3 Assist links to the report instead of repeating them.
Data & privacy
| Hog3 Assist uses | Details |
|---|---|
| Your engagement | Finding titles, severity, affected hosts, impact and remediation guidance. PoC code and credentials are excluded. |
| Remediation history | Statuses, comments and re-test results created in Slack. |
| The Slack thread | Messages in the thread where it was mentioned, to understand follow-ups. |
| Public advisories | OSV.dev, FIRST EPSS and CISA KEV, for vulnerability checks. |
Answers are generated by Claude, Anthropic’s AI model. Thread content is sent to the model only to answer your question. Hog3 Assist reads only threads where it’s mentioned or that it’s already part of.
Troubleshooting
Hog3 Assist doesn’t reply in the channel
Make sure you mentioned @Hog3 Assist and the app is in the channel. If it says the channel isn’t connected, ask your Hog3 contact to connect it.
“Your workspace isn’t connected to this engagement”
Your Slack workspace joined the channel after it was connected. Ask your Hog3 contact to reconnect the channel so your workspace is included.
It ignores my replies in a thread
Only the person who started the conversation can reply without a mention. Mention @Hog3 Assist, or start your own thread.
“This thread is closed”
The thread reached its reply limit, was idle for a week, or someone from an unconnected workspace joined. Start a new thread.
Re-test says “needs a manual re-test”
That finding has no safe automated check. Ask Hog3 Assist to escalate, and the Hog3 team will schedule a manual re-test.
I can’t open the report
Report access uses an approved email list. Ask Hog3 Assist to escalate, or ask your Hog3 contact to add your email.