Microsoft Teams via Webhook

Integration for sending notifications to a Microsoft Teams channel via a workflow of type `Post to a channel when a webhook request is received`.

Messaging and Conferencing · Microsoft Teams

Details

ID	`Microsoft Teams via Webhook`
Provider	Microsoft
Category	Messaging and Conferencing
From Version	6.2.0
Docker Image	`demisto/python3:3.12.13.10116658`
Supported Modules	Agentix Cortex Cloud Cloud Runtime Security Cloud Posture Security XSIAM EDR

README

Integration for sending notifications to a Microsoft Teams channel via workflow.
This integration was integrated and tested with version 6.8 of Microsoft Teams via Webhook

Configure Microsoft Teams via Webhook in Cortex

Parameter	Description	Required
Microsoft workflow URL	The workflow URL in the Teams Channel	True
Trust any certificate (not secure)		False
Use system proxy settings		False

Commands

You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

ms-teams-message

Send a message to Microsoft Teams via Incoming Webhook.

Base Command

ms-teams-message

Input

Argument Name	Description	Required
message	The message to send. For example: “This is a message from Cortex XSOAR”. To use a newline use \n\n or \r\r. Default is None.	Optional
team_webhook	The alternative webhook for a different team. If not defined, the integration’s default webhook is used.	Optional
alternative_url	The alternative URL to send in place of the link to the Cortex XSOAR Investigation.	Optional
url_title	The title for the link. Default is Cortex XSOAR URL.	Optional
adaptive_cards_format	Should the adaptive card format be used or a single text message. Possible values are: true, false. Default is True.	Optional
overwrite_adaptive_card_json	JSON object used to overwrite the default adaptive card JSON.	Optional

Context Output

There is no context output for this command.

Troubleshooting

By default the message is being sent with a message template: X Used a Workflow template to send this card.
In order to eliminate this line you can use the following approach:

Navigate to Microsoft’s Power Automate portal and sign into your Microsoft Teams account where you’ve previously set up the Flow.
Click My flows from the left side menu.
Click the newly created Flow to open its details page.
On the Flow’s details page, click Save As.
Give your new Flow a name and click **Save””.
Navigate back to My flows from the left side menu.
Find the copy Flow and click its name to access its details page.
On the Flow’s details page, click Turn On.
In order to find the new URL link, navigate to the Edit tab on the Flow’s details page.
Click the action task and copy the HTTP URL.
Configure an instance of the integration and add the copied Workflow URL for the Teams channel.

Configuration parameters

webhookurl — Microsoft workflow URL (required)
insecure — Trust any certificate (not secure)
proxy — Use system proxy settings

Commands (1)

ms-teams-message
Send a message to Microsoft Teams via Incoming Webhook.

Source

MicrosoftTeamsWebhook.py MicrosoftTeamsWebhook_test.py MicrosoftTeamsWebhook.yml MicrosoftTeamsWebhook_description.md command_examples.txt

Download History Raw

Use the Microsoft Teams Webhook integration to send messages and notifications to Teams configured with an incoming webhook or a workflow.  When using an adaptive card, the message will always include a link back to the investigation from which it was sent.

## Create a workflow in Microsoft Teams.
First, [Install the Workflows app in Microsoft Teams](https://learn.microsoft.com/en-us/power-automate/teams/install-teams-app).<br/>
Second, [Browse and add workflows in Microsoft Teams Create a workflow to support Teams Webhook](https://support.microsoft.com/en-us/office/browse-and-add-workflows-in-microsoft-teams-4998095c-8b72-4b0e-984c-f2ad39e6ba9a). <br/>
Create a workflow of type `Post to a channel when a webhook request is received` and follow the set up instructions.<br/>
In order to create an instance of the Microsoft Teams Webhook in Cortex XSOAR, complete the following:

1. Add an instance of the integration and add the Workflow URL for the Teams channel.
2. Test the integration. If successful, you'll see a test message in the channel.


## Support for Multiple Teams

This integration supports sending messages to additional Teams via a workflow.  There are 2 methods for this:

- Configure additional integration instances, adding the workflow URL for each Team. You can then send notifications to multiple teams at once, or select the integration instance to use via the playbook task editor.

- The ***ms-teams-message*** command includes the *team_webhook* argument, which allows you to pass an alternative workflow URL to override the one from the integration settings.  

You can store the additional workflow in a Cortex XSOAR list, and use a transformer on the task in a playbook to send to a specific team.  

For example, create a list containing a dictionary where the **Key** is the Team, and the **Value** is the webhook for that team.

```
{
"ReadyTeamOne":"workflow url",
"ReadyTeamTwo":"workflow url"
}
```

You can then pass the list into the *team_webhook* argument, and use the GetField transformer with the value of the Team   (i.e., ReadyTeamOne) to retrieve the workflow URL that will be used to override the default from the integration instance, and send the message. <br/>

For more information, see the [integration documentation](https://xsoar.pan.dev/docs/reference/integrations/microsoft-teams)

---
[View Integration Documentation](https://xsoar.pan.dev/docs/reference/integrations/microsoft-teams-via-webhook)