StratoSecure - Notify Microsoft Teams

Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · Logic Apps · 📊

↑ Back to Content Index

When a Microsoft Sentinel incident is created from a StratoSecure finding, this playbook posts an adaptive card notification to a Microsoft Teams channel via incoming webhook. Human approval is always required before the action executes.

Attribute	Value
Type	Playbook
Solution	StratoSecure
Source	View on GitHub

Tables Used

This content item queries data from the following tables:

Table	Transformations	Ingestion API	Lake-Only
`StratoSecure_PlaybookRuns_CL`	?	✓	?

Logic App Connectors

This playbook uses 3 Logic App connectors / built-in actions:

Connector / Action	Type	Connections	Actions
`azureloganalyticsdatacollector`	Managed	1	1
`azuresentinel`	Managed	1	0
`http`	Built-in	0	1

Action parameters (URLs, paths, function IDs)

`azureloganalyticsdatacollector` (Managed)

Action	Method	Endpoint	Other
Action_AuditLog	post	`/api/logs`	—

`http` (Built-in)

Action	Method	Endpoint	Other
Action_PostToTeams	POST	`[parameters('TeamsWebhookUrl')]`	—

Additional Documentation

📄 Source: StratoSecure-NotifyTeams/readme.md

StratoSecure — Notify Teams

Sends a Microsoft Teams notification with a summary of the triggered security incident and links to the StratoSecure finding detail.

Prerequisites

Microsoft Sentinel workspace
Microsoft Teams incoming webhook URL
StratoSecure Platform API key (generated at client.stratocode.io)

Post-Deployment Steps

Grant the Logic App system-assigned managed identity the Microsoft Sentinel Responder role on the Sentinel workspace.
Configure the Teams webhook URL as a Sentinel automation rule trigger.

Parameters

Parameter	Type	Description
PlaybookName	string	Logic App resource name
TeamsWebhookUrl	securestring	Microsoft Teams incoming webhook URL
LogAnalyticsWorkspaceId	string	Workspace ID for audit logging
LogAnalyticsWorkspaceKey	securestring	Workspace primary key for audit logging
RequireApproval	bool	When true, actions execute only after approval condition evaluates (default: true)