topic Re: Risk/Security Assessment Integration to MS Teams using Webhook in Open Q&A

Risk/Security Assessment Integration to MS Teams using Webhook

echwallah — Fri, 01 Dec 2023 08:15:07 GMT

We are having an observation that has poised a security risk using the webhook for custom Integations and MS Teams.

The security teams made the below findings.

Vulnerability	Severity	Remediation
Sensitive Data Tampering	High	· Encrypt payload to ensure the integrity and confidentiality of data.

Is there a mechanism to encrypt/obfuscate the payload from Dynatrace in order to address these risk as mentioned..

How can this be mitigated?

Re: Risk/Security Assessment Integration to MS Teams using Webhook

Alexander_Mohr — Tue, 05 Dec 2023 07:51:24 GMT

Hi,

Thanks for pointing this out. I suggest using the native MS Teams for Workflow integration. Security-relevant information like tokens or incoming webhook URL, which includes tokens are managed within settings, are masked, and can't be extracted by the user.

If you want to leverage HTTP(s) requests within workflows, I suggest using Credential Vault to manage and access tokens within a web request.

Does this address your concern?

BR Alexander

Re: Risk/Security Assessment Integration to MS Teams using Webhook

andre_vdveen — Thu, 07 Dec 2023 08:22:39 GMT

Hi Erick,

The payload is not exposed while traversing the network, as long as the webhook to MS Teams is using https, which it does by default as far as I'm aware; the concern you raise is based on what is visible in the browser/Burp, which makes sense as the endpoint is trusted and the payload is not encrypted anymore.

Therefore, if the security concern is related to potential authenticated malicious users, I understand the concern but as Alexander said, your other option is to use the integration via Workflows.

Regards,
André

Re: Risk/Security Assessment Integration to MS Teams using Webhook

Peter_Youssef — Wed, 18 Sep 2024 06:13:28 GMT

Hi @echwallah

As highlighted by @andre_vdveen , @Alexander_Mohr

you can also check with Microsoft team the attached URL: Create an Incoming Webhook - Teams | Microsoft Learn
you can enable

For Credential vault feel free to review what might be applicable for current setup: External vault integration - Dynatrace Docs

Send Dynatrace notifications to Microsoft Teams - Dynatrace Docs