MicrosoftGraphTeamsStandardConnector
This integration is configured automatically as part of the Microsoft 365 Standard Connector. Do not configure this integration directly — set it up from the connector page instead.
Messaging and Conferencing · Microsoft Graph Teams (Standard Connector)
Details
| ID | MicrosoftGraphTeamsStandardConnector |
|---|---|
| Provider | Microsoft |
| Category | Messaging and Conferencing |
| From Version | 8.15.0 |
| Docker Image | demisto/crypto:1.0.0.11658507 |
| Supported Modules | Agentix Cloud Runtime Security Cloud Posture Security XSIAM EDR Cortex Cloud |
README
This integration is configured automatically as part of the Microsoft 365 Standard Connector. Do not configure this integration directly — set it up from the connector page instead.
Configure Microsoft Graph Teams (Standard Connector) in Cortex
| Parameter | Description | Required |
|---|---|---|
| Server URL | The Microsoft Graph server URL. | False |
| Tenant ID | The Microsoft Entra ID tenant ID of the registered application. | True |
| Client ID | The application (client) ID of the registered application. | True |
| Client Secret | The client secret of the registered application. | True |
| Trust any certificate (not secure) | Whether to trust any certificate presented by the server. | False |
| Use system proxy settings | Whether to route requests through the system proxy. | False |
Commands
You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.
msgraph-teams-message-update-policy-violation
Applies a data loss prevention (DLP) policy violation to a Microsoft Teams message. Targets a chat message, a channel message, or a channel reply.
Base Command
msgraph-teams-message-update-policy-violation
Input
| Argument Name | Description | Required |
|---|---|---|
| chat_id | The chat ID hosting the message. Provide either ‘chat_id’ or ‘team_id’ plus ‘channel_id’. | Optional |
| team_id | The team ID hosting the channel message. Required together with ‘channel_id’ when targeting a channel message or reply. | Optional |
| channel_id | The channel ID hosting the message. Required together with ‘team_id’ when targeting a channel message or reply. | Optional |
| parent_message_id | The parent message ID when targeting a channel reply. Only supported for channel messages, not chat messages. | Optional |
| message_id | The ID of the message to update. | Required |
| dlp_action | The action taken on the message by the DLP provider. Possible values are: NoAction, BlockAccess, BlockAccessExternal. | Optional |
| policy_tip_general_text | The general explanatory text shown to the user in the policy tip. | Optional |
| verdict_details | The reviewer actions available on the flagged message. Omit to let Microsoft Graph apply its default (permanent) behavior. | Optional |
| payment_model | The billing model appended as the model query parameter when provided. | Optional |
Context Output
| Path | Type | Description |
|---|---|---|
| MSGraphTeams.TeamsMessagePolicyViolation.messageId | String | The ID of the message the policy violation was applied to. |
| MSGraphTeams.TeamsMessagePolicyViolation.chatId | String | The chat ID hosting the message (when targeting a chat message). |
| MSGraphTeams.TeamsMessagePolicyViolation.teamId | String | The team ID hosting the message (when targeting a channel message). |
| MSGraphTeams.TeamsMessagePolicyViolation.channelId | String | The channel ID hosting the message (when targeting a channel message). |
| MSGraphTeams.TeamsMessagePolicyViolation.parentMessageId | String | The parent message ID (when targeting a channel reply). |
| MSGraphTeams.TeamsMessagePolicyViolation.dlpAction | String | The DLP action applied to the message. |
| MSGraphTeams.TeamsMessagePolicyViolation.verdictDetails | String | The reviewer actions available on the flagged message. |
Command example
!msgraph-teams-message-update-policy-violation chat_id=19:2da4c29f6d7041eca70b638b43d45437@thread.v2 message_id=1616990032035 dlp_action=BlockAccess policy_tip_general_text="This message contains sensitive content." verdict_details=AllowFalsePositiveOverride
Context Example
{
"MSGraphTeams": {
"TeamsMessagePolicyViolation": {
"chatId": "19:2da4c29f6d7041eca70b638b43d45437@thread.v2",
"dlpAction": "BlockAccess",
"messageId": "1616990032035",
"verdictDetails": "AllowFalsePositiveOverride"
}
}
}
Human Readable Output
Teams Message Policy Violation
Chat Id Dlp Action Message Id Verdict Details 19:2da4c29f6d7041eca70b638b43d45437@thread.v2 BlockAccess 1616990032035 AllowFalsePositiveOverride
Configuration parameters
url— Server URLtenant_id— Tenant ID (required)client_id— Client ID (required)secret— Client Secret (required)insecure— Trust any certificate (not secure)proxy— Use system proxy settings
Commands (1)
-
msgraph-teams-message-update-policy-violationApplies a data loss prevention (DLP) policy violation to a Microsoft Teams message. Targets a chat message, a channel message, or a channel reply.
name: MicrosoftGraphTeamsStandardConnector display: Microsoft Graph Teams (Standard Connector) description: 'This integration is configured automatically as part of the Microsoft 365 Standard Connector. Do not configure this integration directly — set it up from the connector page instead.' category: Messaging and Conferencing provider: Microsoft sectionorder: - Connect commonfields: id: MicrosoftGraphTeamsStandardConnector version: -1 configuration: - defaultvalue: https://graph.microsoft.com display: Server URL name: url required: false type: 0 section: Connect additionalinfo: The Microsoft Graph server URL. - display: Tenant ID name: tenant_id required: true type: 4 hiddenusername: true section: Connect additionalinfo: The Microsoft Entra ID tenant ID of the registered application. - display: Client ID name: client_id required: true type: 4 hiddenusername: true section: Connect additionalinfo: The application (client) ID of the registered application. - display: Client Secret name: secret required: true type: 4 hiddenusername: true section: Connect additionalinfo: The client secret of the registered application. - defaultvalue: 'false' display: Trust any certificate (not secure) name: insecure type: 8 required: false section: Connect additionalinfo: Whether to trust any certificate presented by the server. - defaultvalue: 'false' display: Use system proxy settings name: proxy type: 8 required: false section: Connect additionalinfo: Whether to route requests through the system proxy. script: commands: - arguments: - description: The chat ID hosting the message. Provide either 'chat_id' or 'team_id' plus 'channel_id'. name: chat_id - description: The team ID hosting the channel message. Required together with 'channel_id' when targeting a channel message or reply. name: team_id - description: The channel ID hosting the message. Required together with 'team_id' when targeting a channel message or reply. name: channel_id - description: The parent message ID when targeting a channel reply. Only supported for channel messages, not chat messages. name: parent_message_id - description: The ID of the message to update. name: message_id required: true - auto: PREDEFINED description: The action taken on the message by the DLP provider. name: dlp_action predefined: - NoAction - BlockAccess - BlockAccessExternal - description: The general explanatory text shown to the user in the policy tip. name: policy_tip_general_text - description: The reviewer actions available on the flagged message. Omit to let Microsoft Graph apply its default (permanent) behavior. name: verdict_details - description: The billing model appended as the model query parameter when provided. name: payment_model description: Applies a data loss prevention (DLP) policy violation to a Microsoft Teams message. Targets a chat message, a channel message, or a channel reply. name: msgraph-teams-message-update-policy-violation outputs: - contextPath: MSGraphTeams.TeamsMessagePolicyViolation.messageId description: The ID of the message the policy violation was applied to. type: String - contextPath: MSGraphTeams.TeamsMessagePolicyViolation.chatId description: The chat ID hosting the message (when targeting a chat message). type: String - contextPath: MSGraphTeams.TeamsMessagePolicyViolation.teamId description: The team ID hosting the message (when targeting a channel message). type: String - contextPath: MSGraphTeams.TeamsMessagePolicyViolation.channelId description: The channel ID hosting the message (when targeting a channel message). type: String - contextPath: MSGraphTeams.TeamsMessagePolicyViolation.parentMessageId description: The parent message ID (when targeting a channel reply). type: String - contextPath: MSGraphTeams.TeamsMessagePolicyViolation.dlpAction description: The DLP action applied to the message. type: String - contextPath: MSGraphTeams.TeamsMessagePolicyViolation.verdictDetails description: The reviewer actions available on the flagged message. type: String dockerimage: demisto/crypto:1.0.0.11658507 script: '' subtype: python3 type: python runonce: false fromversion: 8.15.0 tests: - No tests (auto formatted)