Are there any apps or add-ons to integrate Microsoft Teams with Splunk Enterprise?

[anandhalagarasa]

Hi Team,

Is there any app or add-on to integrate Microsoft Teams with Splunk. Since once the alert is getting triggered from Splunk end it should reach immediately to Microsoft Teams to the particular channel or teams.

So if there is a way then kindly let me know.

[treinke · Accepted solution]

There is the app to help you connect to MS Teams: https://splunkbase.splunk.com/app/3375/.

Right click on the channel you want the alert to go to and select Connectors. On the right, choose Configure on "Incoming Webhook". Give the incoming webhook a name. I tend to use the alert name as the webhook name. Upload a custom image if you want. Then click Create. That will generate the URL you need to enter in to the Splunk app.

When you setup up the alert in Splunk, make sure the "Microsoft Teams Webhook Alert Connector" app is installed, use the Microsoft Teams action and paste in the webhook URL.

*Note - You need to format the alert in to tables for best results.

[mrccasi]

Hi @treinke -

I am having an issue with sending the alert on the ms teams channel. when the owner of the alert is admin, the alert is sending perfectly fine on the channel. but when the owner of the alert is just a power user, the alert is now sending on the ms teams channel. Can you please advise what is the issue? Is this about the access? Thank you in advance.

[anandhalagarasa]

@anthony reinke , Thanks it works as expected.

[nickhills]

Have a look at this:
https://splunkbase.splunk.com/app/3375/

I have not used this as we wrote our own integration, but its a reasonably straightforward webhook.
Grab the hook url from your teams client, and provide that to the alert