Skip to main content

Setting up alerts for Zoom Team Chat

Integrate Keep Aware with Zoom to send alerts directly to your Zoom Team Chat channels. Alerts are sent through a Zoom incoming webhook, so no Zoom Marketplace app or admin approval is required.

Requirements​

  1. Access to the Keep Aware Console: Ensure you have valid login credentials and are logged in to the console.
  2. Permission to add apps in Zoom: Confirm that you can add the Incoming Webhook app to the Zoom Team Chat channel that will receive alerts.

Getting started​

Set up an incoming webhook in Zoom​

Add the Incoming Webhook app to the Zoom Team Chat channel that will receive alerts. Zoom generates two values you need: the webhook endpoint URL and a verification token. For detailed instructions, refer to Zoom's Incoming Webhook documentation.

Copy both values before leaving Zoom. The verification token is shown with the webhook and is required for Keep Aware to authenticate.

Set up Zoom in Keep Aware​

To get started, navigate to the Integrations Page and select the Zoom integration. This will open a modal where you can select Create New Integration and begin configuring the integration.

Integrations Page Image: Integrations Page

View in console

Configure the following fields:

  • Name — A unique name for your Zoom integration.
  • Webhook — The Zoom Team Chat incoming webhook endpoint URL.
  • Verification token — The verification token Zoom issued with the webhook. Keep Aware stores this value as a secret and sends it on every request.
  • Body — The JSON body that will be sent to Zoom. See below for information on custom alert messages in Zoom.

After saving the integration, add it to a Policy to begin receiving alerts.

Customize the alert sent to Zoom​

All payloads sent to Zoom use wildcards and will be populated with values gathered from the Event or Threat that triggered this integration on a Policy.

Zoom Team Chat doesn't support markdown in incoming webhook messages. Structure comes from Zoom's message content format instead, using a head for the title and a body array for the content beneath it.

Example body with wildcards (all values wrapped in double-curly brackets will be replaced with their corresponding value from the Event):

{
  "content": {
    "head": {
      "text": "Keep Aware Threat Detected",
      "sub_head": {
        "text": "This activity was flagged by the policy, {{policy.label}}"
      }
    },
    "body": [
      {
        "type": "fields",
        "items": [
          {
            "key": "Policy",
            "value": "{{policy.label}}"
          },
          {
            "key": "User",
            "value": "{{user.label}}"
          },
          {
            "key": "Location",
            "value": "{{location}}"
          }
        ]
      },
      {
        "type": "message",
        "text": "View Threat Dashboard",
        "link": "https://console.awarefilter.com/explore/threats"
      }
    ]
  }
}

Further details on all wildcard fields that may be used in the Body are available in our Searching documentation under Event and Threat Fields.

Frequently asked questions​

QuestionAnswer
Do I need to add anything to the webhook URL I copied from Zoom?No. Zoom only parses the message as JSON when the request carries the format=full query parameter, and Keep Aware adds it for you when it sends the alert. Paste the URL exactly as Zoom provides it. If your URL already sets format to another value, Keep Aware leaves your value in place, and the message may post as plain text.
How can I find out what message formatting options are available in Zoom?Message structure and content options are described in Zoom's Incoming Webhook documentation
How can I find out what Event and Threat fields can be forwarded to Zoom?All available Threat and Event fields are described and documented in the Event and Threat Fields Documentation

Table of Contents