You can send incident information from Logsign USO with webhook to Microsoft Teams. Here are the steps to do this.
First of all, you need to be a user with admin authorization on the microsoft side.
You open whichever channel you want to send messages to and click on the 3 dots under your profile photo at the top right and select manage channel.
At the bottom, where it says Connectors, click Edit.
When you type webhook in the search box on the left, you will see the Incoming Webhook option.
You need to give it a name after saying configure.
NOTE: The name you give in this field works like the account you will send the message to, but there are some problems on the microsoft side in this structure. It appears as Unknown User. This may be fixed in the future, when it is fixed, you will need to create a webhook again.
When you click Create it will give you a url and you need to save this url.
After this process, the things we need to do on the Microsoft side are over. Now it is time to complete this integration in Logsign USO.
After selecting Settings > Responses > Webhook, it will be enough to make an edit as below. If success comes when you press test, the integration is successful.
Then you can send Incident data to Microsoft Teams through this integration by creating an Incident or Action Rule.
To use Microsoft Teams Webhook we need to make POST requests, we have to pay attention to this.
You can then create your own draft and edit the information you want to send.
The sample draft is as follows.
Additional Header Json Example;
{"Content-Type": "application/json"}
Additional Payload Json Example;
{
"@type": "MessageCard",
"@context": "https://schema.org/extensions",
"summary": "Log Alert",
"themeColor": "0076D7",
"title": "🚨 $GET['TriggeredAlert.Alert.Info']",
"sections": [{
"activityTitle": "**$GET['TriggeredAlert.Action.Object']",
"activitySubtitle": "$GET['TriggeredAlert.Time.Generated']",
"facts": [
{ "name": "External IP", "value": "$GET['TriggeredAlert.External.IP']" },
{ "name": "AlertUID", "value": "$GET['TriggeredAlert.Alert.AlertUID']" }
],
"markdown": true
}]
}
If you send a payload in this way, you can get a response like below on the teams side.