MicrosoftGraphTeamsStandardConnector

This integration is configured automatically as part of the Microsoft 365 Standard Connector. Do not configure this integration directly — set it up from the connector page instead.

Messaging and Conferencing · Microsoft Graph Teams (Standard Connector)

Details

IDMicrosoftGraphTeamsStandardConnector
ProviderMicrosoft
CategoryMessaging and Conferencing
From Version8.15.0
Docker Imagedemisto/crypto:1.0.0.11658507
Supported ModulesAgentix Cloud Runtime Security Cloud Posture Security XSIAM EDR Cortex Cloud

README

This integration is configured automatically as part of the Microsoft 365 Standard Connector. Do not configure this integration directly — set it up from the connector page instead.

Configure Microsoft Graph Teams (Standard Connector) in Cortex

Parameter Description Required
Server URL The Microsoft Graph server URL. False
Tenant ID The Microsoft Entra ID tenant ID of the registered application. True
Client ID The application (client) ID of the registered application. True
Client Secret The client secret of the registered application. True
Trust any certificate (not secure) Whether to trust any certificate presented by the server. False
Use system proxy settings Whether to route requests through the system proxy. False

Commands

You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

msgraph-teams-message-update-policy-violation


Applies a data loss prevention (DLP) policy violation to a Microsoft Teams message. Targets a chat message, a channel message, or a channel reply.

Base Command

msgraph-teams-message-update-policy-violation

Input

Argument Name Description Required
chat_id The chat ID hosting the message. Provide either ‘chat_id’ or ‘team_id’ plus ‘channel_id’. Optional
team_id The team ID hosting the channel message. Required together with ‘channel_id’ when targeting a channel message or reply. Optional
channel_id The channel ID hosting the message. Required together with ‘team_id’ when targeting a channel message or reply. Optional
parent_message_id The parent message ID when targeting a channel reply. Only supported for channel messages, not chat messages. Optional
message_id The ID of the message to update. Required
dlp_action The action taken on the message by the DLP provider. Possible values are: NoAction, BlockAccess, BlockAccessExternal. Optional
policy_tip_general_text The general explanatory text shown to the user in the policy tip. Optional
verdict_details The reviewer actions available on the flagged message. Omit to let Microsoft Graph apply its default (permanent) behavior. Optional
payment_model The billing model appended as the model query parameter when provided. Optional

Context Output

Path Type Description
MSGraphTeams.TeamsMessagePolicyViolation.messageId String The ID of the message the policy violation was applied to.
MSGraphTeams.TeamsMessagePolicyViolation.chatId String The chat ID hosting the message (when targeting a chat message).
MSGraphTeams.TeamsMessagePolicyViolation.teamId String The team ID hosting the message (when targeting a channel message).
MSGraphTeams.TeamsMessagePolicyViolation.channelId String The channel ID hosting the message (when targeting a channel message).
MSGraphTeams.TeamsMessagePolicyViolation.parentMessageId String The parent message ID (when targeting a channel reply).
MSGraphTeams.TeamsMessagePolicyViolation.dlpAction String The DLP action applied to the message.
MSGraphTeams.TeamsMessagePolicyViolation.verdictDetails String The reviewer actions available on the flagged message.

Command example

!msgraph-teams-message-update-policy-violation chat_id=19:2da4c29f6d7041eca70b638b43d45437@thread.v2 message_id=1616990032035 dlp_action=BlockAccess policy_tip_general_text="This message contains sensitive content." verdict_details=AllowFalsePositiveOverride

Context Example

{
    "MSGraphTeams": {
        "TeamsMessagePolicyViolation": {
            "chatId": "19:2da4c29f6d7041eca70b638b43d45437@thread.v2",
            "dlpAction": "BlockAccess",
            "messageId": "1616990032035",
            "verdictDetails": "AllowFalsePositiveOverride"
        }
    }
}

Human Readable Output

Teams Message Policy Violation

Chat Id Dlp Action Message Id Verdict Details
19:2da4c29f6d7041eca70b638b43d45437@thread.v2 BlockAccess 1616990032035 AllowFalsePositiveOverride

Configuration parameters

  • url — Server URL
  • tenant_id — Tenant ID (required)
  • client_id — Client ID (required)
  • secret — Client Secret (required)
  • insecure — Trust any certificate (not secure)
  • proxy — Use system proxy settings

Commands (1)

  • msgraph-teams-message-update-policy-violation

    Applies a data loss prevention (DLP) policy violation to a Microsoft Teams message. Targets a chat message, a channel message, or a channel reply.

name: MicrosoftGraphTeamsStandardConnector
display: Microsoft Graph Teams (Standard Connector)
description: 'This integration is configured automatically as part of the Microsoft 365 Standard Connector. Do not configure this integration directly  set it up from the connector page instead.'
category: Messaging and Conferencing
provider: Microsoft
sectionorder:
- Connect
commonfields:
  id: MicrosoftGraphTeamsStandardConnector
  version: -1
configuration:
- defaultvalue: https://graph.microsoft.com
  display: Server URL
  name: url
  required: false
  type: 0
  section: Connect
  additionalinfo: The Microsoft Graph server URL.
- display: Tenant ID
  name: tenant_id
  required: true
  type: 4
  hiddenusername: true
  section: Connect
  additionalinfo: The Microsoft Entra ID tenant ID of the registered application.
- display: Client ID
  name: client_id
  required: true
  type: 4
  hiddenusername: true
  section: Connect
  additionalinfo: The application (client) ID of the registered application.
- display: Client Secret
  name: secret
  required: true
  type: 4
  hiddenusername: true
  section: Connect
  additionalinfo: The client secret of the registered application.
- defaultvalue: 'false'
  display: Trust any certificate (not secure)
  name: insecure
  type: 8
  required: false
  section: Connect
  additionalinfo: Whether to trust any certificate presented by the server.
- defaultvalue: 'false'
  display: Use system proxy settings
  name: proxy
  type: 8
  required: false
  section: Connect
  additionalinfo: Whether to route requests through the system proxy.
script:
  commands:
  - arguments:
    - description: The chat ID hosting the message. Provide either 'chat_id' or 'team_id' plus 'channel_id'.
      name: chat_id
    - description: The team ID hosting the channel message. Required together with 'channel_id' when targeting a channel message or reply.
      name: team_id
    - description: The channel ID hosting the message. Required together with 'team_id' when targeting a channel message or reply.
      name: channel_id
    - description: The parent message ID when targeting a channel reply. Only supported for channel messages, not chat messages.
      name: parent_message_id
    - description: The ID of the message to update.
      name: message_id
      required: true
    - auto: PREDEFINED
      description: The action taken on the message by the DLP provider.
      name: dlp_action
      predefined:
      - NoAction
      - BlockAccess
      - BlockAccessExternal
    - description: The general explanatory text shown to the user in the policy tip.
      name: policy_tip_general_text
    - description: The reviewer actions available on the flagged message. Omit to let Microsoft Graph apply its default (permanent) behavior.
      name: verdict_details
    - description: The billing model appended as the model query parameter when provided.
      name: payment_model
    description: Applies a data loss prevention (DLP) policy violation to a Microsoft Teams message. Targets a chat message, a channel message, or a channel reply.
    name: msgraph-teams-message-update-policy-violation
    outputs:
    - contextPath: MSGraphTeams.TeamsMessagePolicyViolation.messageId
      description: The ID of the message the policy violation was applied to.
      type: String
    - contextPath: MSGraphTeams.TeamsMessagePolicyViolation.chatId
      description: The chat ID hosting the message (when targeting a chat message).
      type: String
    - contextPath: MSGraphTeams.TeamsMessagePolicyViolation.teamId
      description: The team ID hosting the message (when targeting a channel message).
      type: String
    - contextPath: MSGraphTeams.TeamsMessagePolicyViolation.channelId
      description: The channel ID hosting the message (when targeting a channel message).
      type: String
    - contextPath: MSGraphTeams.TeamsMessagePolicyViolation.parentMessageId
      description: The parent message ID (when targeting a channel reply).
      type: String
    - contextPath: MSGraphTeams.TeamsMessagePolicyViolation.dlpAction
      description: The DLP action applied to the message.
      type: String
    - contextPath: MSGraphTeams.TeamsMessagePolicyViolation.verdictDetails
      description: The reviewer actions available on the flagged message.
      type: String
  dockerimage: demisto/crypto:1.0.0.11658507
  script: ''
  subtype: python3
  type: python
  runonce: false
fromversion: 8.15.0
tests:
- No tests (auto formatted)