InsightIDR UBA Alerts to Teams Channel

Looking for some guidance. I’d like to post all my IDR alerts to a teams channel using ICON for easy mobile viewing. I’ve been able to do this with custom alerts however haven’t figured out how to do the same with the UBA Alerts. The only thing I got working for that is to take a manual action within the UBA alerts to post to teams… Can anyone give any pointers on how to automate this? FYI I am a new to these products.

Have you seen the Automation documentation of InsightIDR.
Maybe the Alert trigger page provides the information you need: Alert Triggers | InsightIDR Documentation

2 Likes

Hey @joe_delavalle, thanks for the question! We actually published a workflow to the Extension Library a few weeks ago that might help you out: IDR Alert Routing with Microsoft Teams. The workflow was designed to deliver InsightIDR Alerts to a specific Teams channel based on AD group membership, allowing you to differentiate between ‘critical’ and ‘non-critical’ users. As an example, you may set the Domain Admins group as ‘critical’, and anyone not part of that group would be considered ‘non-critical’.

The Documentation tab of that workflow listing provides all the instructions you’d need to get that activated in your environment, but let us know if you have any follow-up questions!

2 Likes

This was helpful - Thank you.

This was also helpful. Going to look at this as well thank you.

1 Like

Hi @ilyaaz_noerkhan

Your suggestion worked great for the UBA alerts… Any pointers on how to accomplish the same with ABA alerts?

Hi @joe_delavalle, unfortunately we do not yet support a specific experience for running InsightConnect workflows for ABA alerts just yet. The good news though is that we are looking into this right now!

If you would be interested, we would love to chat more with you about this and maybe share some thoughts on how this experience could work and get your thoughts?

Hi @tyler_terenzoni, I would certainly be open to that.

Appreciate it, I will reach out to you directly!

For anyone else who peeks into this thread, if you are also interested in having those discussions please respond here and I can reach out to you as well.