Introduction.

Many Security Operation Centres (SOCs) rely on rapid, structured, and context-rich alerting mechanisms.

This blog outlines how to build an interactive, dynamic workflow to send Microsoft Sentinel incidents to Microsoft Teams using an Azure Logic App and Adaptive Cards.

This solution enables SOC teams to:

• Receive incident alerts in real time within Microsoft Teams.

• View key incident metadata in a clean UI.

• Take action such as changing severity or closing incidents.

• Operate entirely within Microsoft Teams, improving speed and reducing context-switching.

---

Prerequisites:

To complete this interaction, you’ll need the following:

• A Microsoft Sentinel instance (active and connected to a Log Analytic Workspace).

• Azure Logic App (Standard or Consumption).

• Microsoft Teams with an appropriate channel.

• Adaptive Card Designer (adaptivecards.io)

• Contributor permissions on the relevant resource group.

---

Example.

---

Step 1: Designing the Adaptive Card.

The Adaptive Card is the UI element that appears in Teams. Begin by building your Adaptive Card using the web-based Designer tool. Set the host app to "Microsoft Teams - Dark" to preview how it will render in Teams.

Card content:

1. Header Text: Large title (e.g. “New Microsoft Sentinel Incident Created!”)

2. Microsoft Sentinel Logo: Insert into a left-hand column using image URL
   https://connectoricons-prod.azureedge.net/releases/v1.0.1391/1.0.1391.2130/azuresentinel/icon.png

3. Clickable Incident Link: Markdown [Click here to view the Incident](incidentURL)

4. FactSet Section: Display the following dynamically retrieved incident properties:

   1. Incident Title

   2. Incident ID

   3. Creation Time (UTC)

   4. Severity (with conditional colours)

   5. Alert Providers (joined with ; )

   6. MITRE ATT&CK Tactics (joined with ; )

   7. Description

Action section:

Beneath the incident details:

1. Dropdown: Close Incident
   ID: incidentStatus
   Choices:

   Close incident - False Positive → FalsePositive – IncorrectAlertLogic

   • Close incident - True Positive → TruePositive – SuspiciousActivity

   • Close incident - Benign Positive → BenignPositive – SuspiciousButExpected

   • Don’t close the incident → no (default)

2. Dropdown: Change Severity
   ID: incidentSeverity

   Choices:

   • High

   • Medium

   • Low

   • Informational

   • Don’t change → same (default)

3. Submit Button
   Title: “Submit response!”

Copy the card JSON from the “Card Payload Editor” once built.

---

Step 2: Create the Azure Logic App.

1. Navigate to Microsoft Sentinel > Automation > Create > Playbook with incident trigger.

2. Configure:

   • Name: Send-Teams-Adaptive-Card-on-incident-creation

   • Resource Group: Your Sentinel resource group

   • Identity: Use a Managed Identity

3. Proceed to the Logic App Designer.

---

Step 3: Define Logic App Actions.

3.1: Compose the Adaptive Card:

1. Add a Compose action.

2. Paste your full Adaptive Card JSON (designed earlier).

3. Replace static placeholders with dynamic content from the Sentinel trigger.

Examples:

"value": "@{triggerBody()?['object']?['properties']?['title']}"

For arrays like Alert Providers:

"value": "@{join(triggerBody()?['object']?['properties']?['additionalData']?['alertProductNames'], '; ')}"

3.2: Post to Teams:

• Add an action: Microsoft Teams > Post adaptive card and wait for a response.

• Configure:

  • Post as: Flow bot

  • Post in: Teams channel

  • Message: Outputs from Compose

  • Update message: "Thanks for your response!"

---

Step 4: Process the Response.

4.1: Update Severity:

• Add Condition: if incidentSeverity is not equal to same

• Under True:

  • Add Update Incident (Sentinel)

  • Pass new severity from the card response using:

      body('Post_Adaptive_Card_and_wait_for_a_response')?['data']?['incidentSeverity']
    

4.2: Close the Incident:

• Add another Condition: if incidentStatus is not equal to no

• Under True:

  • Add Update Incident with status Closed

  • Add classification reason based on card input

---

Enhancements and Best Practices.

• Use attention, warning, and good colours to visually reflect incident severity

• Embed Sentinel and company logos in the card for professional branding

• Add follow-up cards or messages to Teams confirming actions taken

• Consider including user feedback or quick triage options (e.g. "Is this activity expected?")

---

Conclusion.

This integration brings security events directly into the operational workflow, reducing response time and enabling immediate action within Microsoft Teams. By automating incident delivery and embedding response options into the conversation flow, this method enhances visibility and efficiency in SOC environments.

---

→ Next Steps:

• Add enrichment (e.g. GeoIP, Identity Risk Levels).

• Extend with logic for multi-stage approvals.

• Publish your Adaptive Card JSON to internal GitHub for standardisation.

• Use role-based access to scope which alerts trigger playbooks.

Let incidents come to the team — not the other way around.