Microsoft Teams

Create Teams Message

The purpose of this example is to create a message in a Teams Channel when a Vulnerability is created in AttackForge.

This example Flow can be downloaded from our Flows GitHub Repository and imported into your AttackForge.

Initial Set Up

• Event: Vulnerability Created

• Secrets:

  • teams_auth - your Incoming Web Hook

Action 1 - Post Teams Message

• Method: POST

• URL: <YOUR-INCOMING-WEBHOOK>

• Headers:

  • Key = Content-Type; Type = Value; Value = application/json

  • Key = Accept; Type = Value; Value = */*

• Request Script:

let afProjectId;
let afProjectName;

if (data.vulnerability_projects) {
  for (let i = 0; i < data.vulnerability_projects.length; i++) {
    if (data.vulnerability_projects[i].id && data.vulnerability_projects[i].name) {
      afProjectId = data.vulnerability_projects[i].id;
      afProjectName = data.vulnerability_projects[i].name;
      break;
    }
  }
}

if (!afProjectId) {
  return {
    decision: {
      status: 'abort',
      message: 'afProjectId is falsy'
    }
  };
}

if (!afProjectName) {
  return {
    decision: {
      status: 'abort',
      message: 'afProjectName is falsy'
    }
  };
}

let text = '';

if (data.vulnerability_priority) {
  text += '[' + data.vulnerability_priority + '] ';
}

text += 'Vulnerability ';

if (data.vulnerability_title) {
  text += '[' + data.vulnerability_title + '] ';
}

text += 
  'discovered in Project' + 
  ' [' + afProjectName + ']' + 
  ' - [View Vulnerability](https://afe1.attackforge.dev/projects/' + afProjectId + '/vulnerabilities/' + data.vulnerability_id + ')';


return {
  request: {
    url: 'https://prod-26.australiasoutheast.logic.azure.com:443/workflows/e25ebc22ccf5438190dc46a087450e5c/triggers/manual/paths/invoke?api-version=2016-06-01&sp=%2Ftriggers%2Fmanual%2Frun&sv=1.0&sig=' + secrets.sig,
    body: {
      type: 'message',
      attachments: [
        {
          contentType: 'application/vnd.microsoft.card.adaptive',
          content: {
            $schema: 'http://adaptivecards.io/schemas/adaptive-card.json',
            type: 'AdaptiveCard',
            version: '1.2',
            body: [
              {
                type: 'TextBlock',
                text: text
              }
            ]
          }
        }
      ]
    }
  }
};

• Response Script:

if (response?.statusCode === 202) {
  return {
    decision: 'continue'
  };
}
else {
  Logger.error(JSON.stringify(response));

  return {
    decision: { 
      status: 'abort',
      message: 'TEAMS message not posted',
    },
  };   
}