Skip to main content

Cyware Fusion and Threat Response

Integrate Microsoft Teams

Integrate Microsoft Teams with Respond to receive immediate notifications regarding incident updates on your Microsoft Teams channel. Configure a team and channel from Microsoft Teams to receive incident update notifications. Users of the configured channel will receive instant incident update notifications even without access to the Respond application.

Before you Start

  • Ensure that Orchestrate is integrated and enabled inRespond. For more information, see Integrate Orchestrate.

  • You must have Create/Update permission for Configurations.

Steps

  1. Install Microsoft Teams in Orchestrate

  2. Create Microsoft Teams Instance

  3. Configure Microsoft Teams Channel

Install Microsoft Teams in Orchestrate

To integrate Microsoft Teams with Respond, you must install Microsoft Teams application version 1.2.0 or above in Orchestrate.

To install the Microsoft Teams app on Orchestrate, follow these steps:

  1. Sign in to Orchestrate.

  2. Go to Main Menu > Apps, and select Appstore.

  3. Search and open the Microsoft Teams app.

  4. Click Install.

  5. Select a version, and click Install. You must select Microsoft Teams version 1.2.0 or above.

The Microsoft Teams app is installed on Orchestrate, and you can find the app in the My Apps tab.

Create Microsoft Teams Instance

To enable application-level communication between Microsoft Teams and Respond, you must configure an instance of the Microsoft Teams application. You can either use an existing instance of Microsoft Teams in Orchestrate or create a new instance in Respond or Orchestrate. For more information, see Microsoft Teams.

Before you Start

  • Ensure that a Microsoft Teams app with version 1.2.0 or above is installed on Orchestrate.

  • Ensure that you have valid open API credentials to create a Microsoft Teams instance. The API token must have the following permissions:

    • Team.ReadBasic.All: Retrieves a list of teams from the configured instance.

    • ChannelMember.Read.All: Retrieves a list of channels of a team.

    • ChannelMessage.Send: Sends messages in a channel.

    • ChatMessage.Send: Sends messages in a chat.

Steps

To create a Microsoft Teams instance in Respond, follow these steps:

  1. Go to Admin Panel > Configurations > Integration > Cyware Orchestrate.

  2. Go to Microsoft Teams, and click Edit.

  3. In Select Instance, click New Instance.

  4. Enter the following details:

    • Instance Name: Enter a unique name for the instance. For example, MSTeams_notifications.

    • Instance Description: Enter a description for the instance. For example, Creating this instance to integrate MS Teams with Respond.

    • Instance Expiration: Enter an expiration date for the instance. Incident notifications are not sent to an expired instance.

    • Username: Enter the username of the user account associated with the API credentials of Microsoft Teams. For example, user@sampledomain.com.

    • Password: Enter the password of the user account associated with the API credentials of Microsoft Teams.

    • Client ID: Enter the Microsoft Teams application ID. You can retrieve the client ID from the Microsoft Teams application registration portal. For example, 8m7r499d-6a45-4c99-b4d8-e4a6b99979b.

    • Client Secret: Enter the secret key of the client.

    • Tenant ID: Enter the Azure Active Directory tenant ID of the Microsoft Teams instance. You can enter the tenant ID in both GUID and domain name formats. For example, 421c85c3-3791-4b2d-5dd6-6fa64bc1b232.

  5. Click Create.

An instance is created for the latest available Microsoft Teams app version in Orchestrate.

Configure Microsoft Teams Channel

Configure a Microsoft Teams channel to receive incident update notifications on a channel.

Before you Start

Ensure that an instance is created for the Microsoft Teams app version 1.2.0 or above.

Steps

To configure a Microsoft Teams channel, follow these steps:

  1. Go to Admin Panel > Configurations > Integration > CywareOrchestrate.

  2. Go to Microsoft Teams, and click Edit.

  3. Enter the following details:

    • Select Instance: Select a Microsoft Teams instance.

    • Select Team: Select a team from your Microsoft Teams instance to receive incident updates. Ensure that teams are configured in the instance.

    • Select Channel: Choose whether you want to send incident notifications to a public or private channel. Then, select a channel to which you want to receive incident update notifications. Ensure that channels are configured in the instance.

  4. Turn on the toggle, and click Save.

To ensure integration is successful, you can test the connectivity by clicking test-connectivity.png.

After successful integration, analysts must enable Microsoft Teams notifications for incidents they want to be updated about in the configured channel. For more information on how to enable Microsoft Teams notifications for an incident, see Enable Microsoft Teams Notifications for an Incident.