The Microsoft Teams integration enables ARMO users to receive security alerts over Microsoft Teams channels. Alerts can be filtered to control their volume by configuring their severity level.

When ARMO Platform scans your cluster, you will receive notifications on Teams regarding the following:

1. A new vulnerability is detected in your cluster (severity is configurable)
2. Fix is available for a vulnerability that affects your cluster (severity is configurable)
3. The Compliance score has decreased by > X%
4. A new cluster admin was added

How to Integrate:

Integrating ARMO Platform with Microsoft Teams is straightforward. Here's a simplified guide to get you started:

Create an Incoming Webhook

1. Follow the prompts to generate an incoming Webhook to connect ARMO Platform to your Microsoft Teams environment:
   1. In Microsoft Teams, choose More options (...) next to the channel name and then choose Connectors.

2. Scroll through the Connectors to Incoming Webhook list, and choose Configure.
   

3. Enter a name for the Webhook, upload an image to associate with data from the Webhook, and choose Create.

4. Copy the Webhook to the clipboard and save it. You’ll need the Webhook URL for sending information to Microsoft Teams.

5. Choose Done.

Access Integrations

1. On ARMO Platform’s main menu navigate to Settings->Integrations and select the ‘Connect’ button on the Microsoft Teams card.

2. Create a Microsoft Teams Alert Channel from the ARMO Platform

   1. Click on + Add webhook.
   2. Name the alert channel.
   3. Add the URL of your Microsoft Teams incoming Webhook.
   4. Choose which clusters and namespaces should be monitored for alerting.
   5. Define which security events trigger notifications in Microsoft Teams. You can tailor these notifications based on severity levels or specific types of incidents. Thus, enabling you to tune the signal-to-noise ratio of the alerts according to your needs.
      

3. Test and Optimize: After setup, click on the button with the envelope icon to send a test message and ensure notifications are flowing smoothly. Iterate and optimize based on feedback from your security and DevOps teams.