https://github.com/osquery/osquery logo
Title
m

marnin

07/29/2022, 7:50 PM
👋 It appears the global failing policies webhook is not compatible with Microsoft Teams. Not sure if error
400. Summary or Text is required
is on Fleet or Teams?
Jul 29 14:32:08 fleet fleet: {"component":"crons","cron":"webhooks:global_failing_policies","err":"posting to \"<https://domain.webhook.office.com/webhookb2/8c786114-5da2-44e3-b414-5b6ea83a0c9e@b92d2b23-4d35-4470-93ff-69aca6632ffe/IncomingWebhook/4d0f8d96de1b486aa8c9a46832bb0940/22c87884-c8a7-42d4-960f-8c2403708e9d>\": error posting to <https://domain.webhook.office.com/webhookb2/8c786114-5da2-44e3-b414-5b6ea83a0c9e@b92d2b23-4d35-4470-93ff-69aca6632ffe/IncomingWebhook/4d0f8d96de1b486aa8c9a46832bb0940/22c87884-c8a7-42d4-960f-8c2403708e9d>: 400. Summary or Text is required.","level":"error","msg":"failed to send failing policies","policyID":20,"ts":"2022-07-29T18:32:08.481657287Z","webhook":"failing_policies"}
k

Kathy Satterlee

07/29/2022, 8:06 PM
At first glance, it looks like Teams requires a field of
summary
or
text
, which isn't provided with the policies webhook. I'll see if I can dig into the documentation a little to see if they offer a workaround or you can set the required fields.
m

marnin

07/29/2022, 8:08 PM
Cool. I looked around Fleet Github issues and the webhook docs https://fleetdm.com/docs/using-fleet/configuration-files#webhooks but didn't see anything. Thanks!
k

Kathy Satterlee

07/29/2022, 8:19 PM
From what I'm seeing, it looks like you'd need to use some kind of intermediary to get the message into a format that Teams would be able to work with.
For example, sending the automation to Jira and then firing a webhook from Jira to Teams.
z

zwass

07/29/2022, 8:24 PM
We've had good luck with the [https://www.tines.com/](Tines) free tier for transforming webhook requests.
m

marnin

07/29/2022, 8:31 PM
Good info, I'll look into that
k

Kathy Satterlee

07/29/2022, 9:03 PM
Thanks, @zwass!
m

marnin

08/04/2022, 4:40 PM
To follow up, I was able to use MS Power Automate to intake the webhook and send it to Teams.
k

Kathy Satterlee

08/04/2022, 4:43 PM
Awesome, thanks for the update!