MS Teams and Insight Connect

tim_mehrley · August 3, 2023, 12:33am

Trying to the get the MS Teams plugin to work with InsightConnect. I can test a workflow such as the Lookup Vulnerable Hosts from Teams and receive input to the channel. However, if I attempt to use the !lookup-vuln-hosts cve-xxxx-xxxx command from the MS Teams channel it never makes it to the Iconn platform and I receive no response. There are also no jobs triggered. Using the MS Teams 4.2.0 connector. Workflows are active and have reviewed the documentation on integrating Teams with IConn to no avail. Any other places to look?

darrick_hall2 · August 3, 2023, 1:05am

Hello Tim.

Just checking on the basics to start. If you navigate to the Team that you want InsightConnect to operate out of, do you see that the user for InsightConnect is a member of the channel?

The Team Name and Channel name are case sensitive. Ensuring they match exactly would be my second step.

I have experienced the scenario where something is hung up on the orchestrator allowing existing Teams workflows to operate as expected, but stopping new Teams triggered workflows from running. This was solved by restarting the orchestrator, and then everything was operational again.

If the restart doesn’t work let me know.

tim_mehrley · August 3, 2023, 3:14pm

Thanks for the feedback. Working on restarting the orchestrator. Team and channel names are correct. The user for Insightconnect is an owner over the channel as well.

tim_mehrley · August 4, 2023, 3:59pm

Orchestrator has been restarted. Still not working. I have also tried mentioning the account in teams with @ then !lookup-vuln-hosts CVE-2016-4171 for example.

darrick_hall2 · August 4, 2023, 5:39pm

@tim_mehrley would you like to hop on a quick zoom? If so my email is darrick_hall@rapid7.com

tim_mehrley · August 24, 2023, 3:53pm

This is still an ongoing issue. We reset the existing orchestrator. No change. We stood up a new orchestrator, no change. We have had our professional services already and they confirmed the setup was accurate and couldn’t get it to work.

Support has looked at it and can’t get it to work.

We purchased this in May and still have a non functioning piece of software. Buyer beware.

tim_mehrley · September 6, 2023, 6:38pm

Just wanted to give an update on this. Turns out the issue was with IPv6. The triggers were using ipv6 but the actions were using ipv4 which is why we could post from Insight connect to the Teams channel but not the other way around. We had to disable Ipv6 on the orchestrator and after restarting the Teams plugin worked.