Skip to main content

Setting Up Alerts for Microsoft Teams

Integrate Keep Aware with Microsoft Teams to send alerts directly to your Microsoft Teams channels.

Requirements​

  1. Access to the Keep Aware Console: Ensure you have valid login credentials and are logged in to the console.
  2. Permissions to add Incoming Webhooks to your Teams Workspace: Confirm that you have the necessary permissions to add new Incoming Webhooks to your Teams environment.

Setup a Webhook in Teams​

First you will need to setup a webhook in Teams or you can use one you have already created.

For information regarding setting up webhooks in Teams refer to their documentation below.

Microsoft Teams Webhooks

Setting up Teams in Keep Aware​

To get started, navigate to the Integrations Page and select the Teams integration. This will open a modal where you can select Create New Integration and begin configuring the integration.

Integrations Page Image: Integrations Page

View in console

Here we will configure each of the fields below:

  • Identifier: A unique name for your Teams Integration.
  • Microsoft Teams Webhook: Your Teams webhook URL.
  • Body: This is the JSON body that will be sent to Teams. See below for information on custom alert messages in Teams.

After you save the integration, that will complete the basic setup for getting Teams connected to Keep Aware.

Continue below for how to customize the body that is sent to Teams.

Customize the Alert Sent to Teams​

All payloads sent to Teams utilize wildcards and will be populated with values gathered from the Event or Threat that triggered this integration on a Policy.

To customize the Teams message payload please refer to their documentation below:

Create and Send Messages

Here is an example body that utilizes wildcards. All values wrapped in double-curly brackets will be replaced with their corresponding value on the Event.

{
  "@type": "MessageCard",
  "@context": "http://schema.org/extensions",
  "themeColor": "121417",
  "summary": "Keep Aware Threat Detected",
  "sections": [
    {
      "activityTitle": "Keep Aware Threat Detected",
      "activitySubtitle": "This activity was flagged by, {{policy.label}}",
      "facts": [
        {
          "name": "Name",
          "value": "{{policy.label}}"
        },
        {
          "name": "User",
          "value": "{{user.label}}"
        },
        {
          "name": "Location",
          "value": "{{location}}"
        }
      ],
      "markdown": true
    }
  ],
  "potentialAction": [
    {
      "@type": "OpenUri",
      "name": "View Threat",
      "targets": [
        {
          "os": "default",
          "uri": "https://console.awarefilter.com/explore/threats"
        }
      ]
    }
  ]
}

Further details on all of the wildcard fields that may be used in the Body are available in our Searching documentation under Event and Threat Fields.

Frequently Asked Questions​

QuestionAnswer
How can I find out what message formatting options are available in Teams?Formatting and structure options are listed in the Create and Send Messages documentation on the Teams webhook documentation page
How can I find out what Event and Threat fields can be forwarded to Teams?All available Threat and Even fields are described and documented in the Event and Threat Fields Documentation

Table of Contents