Chatbots for security and IT teams (Part 1): Microsoft Teams

Last updated on

Written by Thomas KinsellaCo-founder & CCO, Tines


In 2019, Security and IT organizations are finding it harder to source and retain talent, which is why many companies are embracing remote workers and distributed teams. Communicating within and between remote teams is challenging, and many organizations are using communication tools like Slack and Microsoft Teams, and with them, chatbots, to improve communication and collaboration.

Often during a security incident, security teams create virtual rooms to discuss the details, investigate IOCs, and take action. Frequently, multiple teams from different disciplines are invited. On IT and Product Development teams, virtual rooms are often created on a per-project basis to discuss project-specific initiatives and challenges.

This process of collaborating within a chat tool is commonly called “ChatOps” – “a collaboration model that connects people, tools, process, and automation into a transparent workflow” according to Atlassian.

ChatOps can be improved significantly using chatbots – autonomous programs that interact with users within chats. They provide the “automation” part of ChatOps and allow users to take actions from within their chat application. ChatOps and chatbots allow analysts to maintain their focus in one location, and to operate using just one pane of glass – keeping them focused on performing more meaningful and impactful work.

In order for ChatOps to be successful, it requires both the ability to kick off automated actions from within the chat application and an automation solution to send alerts and data back to the chat program either proactively or reactively.

Because most security and IT tools don’t integrate natively with Slack or Microsoft Teams, you can use Tines to connect your tools together by creating a Tines chatbot. These chatbots can leverage the full power of the Tines Automation platform and send data back to Microsoft Teams or Slack.

The idea of chatbots for security and IT teams is not new – security teams in Slack, Netflix and Dropbox, among others, have created open-source chatbots for alerting purposes and for indicator enrichment. Creating your own chatbot which fits your own internal processes allows you to be more flexible in your tool and process choice, and keeps your information private, however you should check out their blogs for useful ideas!

Chatbots blog series 

This series will examine:

  • Setting up chatbots within Microsoft Teams which receives commands from users

  • Using this chatbot to proactively notify and crowdsource information from users within Microsoft Teams

  • Setting up chatbots within Slack which can both take commands and crowdsource information from users

This blog will look at the steps required to set up both a communication bot that receives questions and a proactive notification bot, using Tines and Slack, and Microsoft Teams.

At the end of this first tutorial, you will have created a bot that can receive a command to analyze a domain from any user on your team, and respond with the VirusTotal and URLHaus analysis of that domain.

Microsoft Teams communication bot 

This first tutorial will examine how to set up chatbots within Microsoft Teams which receives commands from users and replies. Before we begin, you’ll need to be, or be working with, an admin on your Microsoft account. You can also read the getting started with Bots guide, here.

Creating an application in Microsoft Teams 

First, let’s begin by Installing App Studio for Microsoft Teams

Select Install. When the installation is complete you should get the following notification:

Now click “Open” on setting up a bot within App Studio.

You can also get to this page by clicking the “more” button ( … ) on the sidebar of teams and selecting App Studio

Give your application a name (e.g. the Security chatbot) and a GUID and version number. (Note, this is the application ID, not the Bot ID which is used later on.)

Give your application a description:

Then enter the Privacy Statement URL, Terms of Use URL, and some branding for your application.

Creating a chatbot for your application 

Now go to the Bots tab on the left-hand side of the page:

Create a Bot and give it the scopes “Personal”, “Team” and “Group Chat.”

You should also save the ID of the Tines chatbot, just above this.

Once you have created your chatbot, click “Generate new password” and keep this safe! This will be used to retrieve your bearer token later.

Now, let’s go to Tines and create a webhook using the Webhook template. Let’s call it “receive commands.”

Copy the webhook URL and enter it in the “Bot Messaging Endpoint” path.

Lastly, let’s add a command to “analyzedomain.”

Click “Add Command.”

Fill out the details of the command text and help text. Choose the scopes “Personal”, “Team” and “Group Chat.”

Now, return to the menu and click “Finish > Test & Distribute.”

Then click “Install.”

Click “Add for You”, and select the relevant team to add the application for your team.

Then click “Install” again.

If you get an error saying “uploading of custom apps is not allowed, then follow the process here. You’ll need to allow sideloading of external apps.

Receiving data in Tines 

Congratulations! You’ve just installed a Tines chatbot!

Now, within your team chat, you should be able to call the “Tines chatbot.”

When you “@” the Tines chatbot you’ll be prompted with the command “analyzedomain” or the command we selected earlier.

Let’s go ahead and enter the domain “” and click enter.

This data will now have been sent by Microsoft Teams to Tines. Check your Webhook Action to make sure data has been sent and received:

If you do not see any data within Tines, make sure the webhook URL specified in the “Bot Messaging Endpoint” above is correct. You should also check that Microsoft Teams is able to reach that webhook (i.e. that it’s not blocked by your Firewall). If you change the webhook address you will need to re-install the application following the instructions above.

Sending a reply to Microsoft Teams 

To reply, let’s take the password you saved earlier and save it as a credential in Tines:

Now, let’s examine more closely the data that Tines receives in the Webhook Action.

Tines has received the text of the query (analyzedomain But Tines has also received several other pieces of information we need to reply:

  • The serviceurl is the base URL that Tines must send data back to using an HTTP Request Action

  • The “from” details tell Tines who to send this reply to

  • The recipient id is the recipient ID (note, not the Bot ID) of the Tines bot – this is needed to send the reply as the Tines bot

Lastly, Tines has received the channelData – this is important for Part 2 when we enumerate all the members of a channel or team.

Our first step is to take the password and Bot ID we saved earlier and request a Bearer Token from Microsoft which we can use to reply. Use the below template to request this token.

We use the bearer token as a credential in the reply.

The reply uses the Service URL, the Conversation ID, and sends the data back to the recipient who sent the message, from the Tines chatbot.

Chaining these results together we can reply to every message sent by a webhook:

Congratulations! You’ve just sent a reply! You can download this basic Story here.

Advanced replies 

Of course, the aim of this Story is to analyze the domain in VirusTotal, URLHaus, and other services and then reply with the results. In Tines, this is pretty easy to do – just use your own tools or templates to perform the analysis and return the details to the requestor. The example below uses VirusTotal and URLHaus.

The first step of this process is to Trigger on the command being used (in this case, analyzedomain):

We can create separate flows for each command as we expand the functionality of the Tines chatbot.

We then extract into an array all the domains in the text.

Tines can then query these domains in VirusTotal and URLhaus, among others.

A complete flow will look like the following:

This Story will reply with simple results to the user like the following:

You can download this complete Story here.

Additional use cases 

Now, that we have a process to receive data from Microsoft Teams and reply, there are near unlimited possibilities of what we can automate within Tines. Other automation steps you can use with the Tines chatbot include:

  • Enrich Domains, IPs, URLs

  • Retrieve User Profile Information from Workday, MSGraph, etc.

  • Escalate Tickets to On Call

  • Create Tickets, Subtickets, or Increase Ticket Severity

  • Add Comments to Tickets

  • Block Domains and IP addresses

  • Query Logs

  • Kick Off Vulnerability Scans and PenTests

  • Isolate Hosts or Lock User Accounts

  • Send Push Notifications to other users

  • Post all updates for an incident in a team room

  • Post all comments from an incident room to an incident ticket

  • Sharing Incident Handover Notes

  • Proactively run any automation Story

Next Up: Part 2 – How to Proactively Send Notifications in Microsoft Teams

*Please note we recently updated our terminology. Our "agents" are now known as "Actions," but some visuals might not reflect this.*

Built by you, powered by Tines

Talk to one of our experts to learn the unique ways your business can leverage Tines.