Skip to content

Microsoft Teams Integration

Receive BreachSpider CVE alerts directly in a Teams channel.

Step 1 - Create an Incoming Webhook in Teams

  1. Open Microsoft Teams
  2. Navigate to the channel where you want alerts
  3. Click the three-dot menu next to the channel name
  4. Select Connectors (or Workflows in newer Teams)
  5. Search for Incoming Webhook
  6. Click Configure, give it a name like "BreachSpider Alerts"
  7. Copy the webhook URL

The URL looks like:

https://yourorg.webhook.office.com/webhookb2/...

Reference: Microsoft Teams Incoming Webhook docs

Step 2 - Add to BreachSpider

In the BreachSpider dashboard:

  1. Navigate to Integrations > Microsoft Teams
  2. Click Add Connection
  3. Paste your Teams webhook URL
  4. Give the connection a name (e.g. "SOC Channel")
  5. Select which events to send:
  6. New KEV matching your assets
  7. Critical CVEs (CVSS 9+)
  8. High CVEs (CVSS 7-8.9)
  9. Exploit confirmed in the wild
  10. Click Test Connection to send a verification message
  11. Click Save

Step 3 - Configure Alert Rules

Navigate to Integrations > Alert Rules to control which environments trigger Teams alerts and at what severity threshold.

Teams Message Format

BreachSpider sends Adaptive Cards to Teams for rich formatting:

CRITICAL CVE ALERT - BreachSpider
CVE-2025-32433 | CVSS 10.0 | KEV

Erlang/OTP SSH Server Unauthenticated RCE

Affected Assets:
- SCADA Middleware Server (Water Treatment Plant Alpha)

BCS Score: 10.0 | EPSS: 59.9% (Top 5%)
Exploit Maturity: POC | Patch Available: Yes

View in BreachSpider ->

Via API

curl -X POST \
  -H "Authorization: Bearer bs_live_..." \
  -H "Content-Type: application/json" \
  -d '{
    "provider": "teams",
    "name": "SOC Channel",
    "config": {
      "webhook_url": "https://yourorg.webhook.office.com/webhookb2/...",
      "events": ["kev.new", "cve.critical"]
    },
    "enabled": true
  }' \
  "https://breachspider.com/api/v1/integrations/connections"

Test an existing connection:

curl -X POST \
  -H "Authorization: Bearer bs_live_..." \
  "https://breachspider.com/api/v1/integrations/connections/3/test"