Risk/Security Assessment Integration to MS Teams using Webhook

[echwallah]

We are having an  observation that has poised a security risk using the webhook for custom Integations and MS Teams.

The security teams made the below findings.

Vulnerability	Severity	Remediation
Sensitive Data Tampering	High	·         Encrypt payload to ensure the integrity and confidentiality of data.

Is there a mechanism to encrypt/obfuscate the payload from Dynatrace in order to address these risk as mentioned..

How can this be mitigated?

[Alexander_Mohr · Accepted solution]

Hi, 

Thanks for pointing this out. I suggest using the native MS Teams for Workflow integration. Security-relevant information like tokens or incoming webhook URL, which includes tokens are managed within settings, are masked, and can't be extracted by the user. 

If you want to leverage HTTP(s) requests within workflows, I suggest using Credential Vault to manage and access tokens within a web request. 

Does this address your concern? 

BR Alexander

[andre_vdveen]

Hi Erick,

The payload is not exposed while traversing the network, as long as the webhook to MS Teams is using https, which it does by default as far as I'm aware; the concern you raise is based on what is visible in the browser/Burp, which makes sense as the endpoint is trusted and the payload is not encrypted anymore.

Therefore, if the security concern is related to potential authenticated malicious users, I understand the concern but as Alexander said, your other option is to use the integration via Workflows.

Regards,
André

[Peter_Youssef]

Hi @echwallah

As highlighted by  @andre_vdveen , @Alexander_Mohr 

1. you can also check with Microsoft team the attached URL: Create an Incoming Webhook - Teams | Microsoft Learn
2. you can enable 

For Credential vault feel free to review what might be applicable for current setup: External vault integration - Dynatrace Docs

Send Dynatrace notifications to Microsoft Teams - Dynatrace Docs