Introduction

IBM Storage Insights (SI) is a software-as-a-service (SaaS) solution that identifies incidents across storage systems that it monitors. These incidents can range from minor system glitches to critical security vulnerabilities (like ransomware). Once an incident is identified, a Microsoft Teams chat can be sent to track and manage it. For example, a potential Ransomware attack needs to be sent to a channel or group.

In this blog post, you will learn how to send SI alerts notifications in real-time to Microsoft teams and create a Message automatically in a Microsoft teams chat. 

Webhook Integration Between IBM Storage Insights and Microsoft teams

First, you need to configure Workflows to receive incoming webhooks. The webhook URL obtained will be used to configure webhook in IBM Storage Insights.

To create and configure MS workflows (HTTP api) and actions for triggering the chat, you'll need to follow these steps:

1. Go to Power automate and Log in

• Ensure you have Paid license or Trail version to configure Workflows.

2. Click on new flow -> instant cloud flow

• A small pop up comes, in which we need to enter the flow name (Enter “SI webhook”) and select When an HTTP request is received.
• click on "create".
• A new flow will be shown.

3. Create a Workflows

• In the new flow, On click of "manual" a side panel will open
• In that select ‘Anyone’ for Who can trigger the flow?

4. Create a compose for timestamp conversion to date

• On click of + icon, a side panel opens and search Compose

• Insert the following javascript in that input box as expresssion. Change the timezone as per your need.

convertFromUtc(
  addSeconds('1970-01-01T00:00:00Z', div(triggerBody()?['occurrenceTimeInMs'], 1000)),
  'India Standard Time',
  'yyyy-MM-dd HH:mm:ss'
)

• After inserting the expression click on ‘Add’.

5. Set up a condition to differentiate between test and real messages.

• Now click on + icon and search ‘Condition’ control and select

• Double click on ‘condition’ in the flow and insert expression triggerBody()?['alertSource'] and ‘testDevice’ as shown in following image

6. Set up an action to send real alert message if condition is true.

• Now, in true box click on + icon and search for ‘Post card in a chat or channel’
• Select Post as, Post in and Group chat name as per your need

• In Adaptive card, enter following json

{
  "type": "AdaptiveCard",
  "version": "1.4",
  "body": [
    {
      "type": "TextBlock",
      "weight": "Bolder",
      "size": "Medium",
      "text": "🚨 @{triggerBody()?['severity']} Alert"
    },
    {
      "type": "TextBlock",
      "text": "Name: @{triggerBody()?['name']}"
    },
    {
      "type": "TextBlock",
      "text": "@{if(empty(triggerBody()?['alert']?['source']?['deviceName']), concat('Device Name: ', triggerBody()?['deviceName']), concat('Device Name: ', triggerBody()?['alert']?['source']?['deviceName']))}",
      "wrap": true
    },
    {
      "type": "TextBlock",
      "text": "Subcategory: @{triggerBody()?['subcatecory']}"
    },
    {
      "type": "TextBlock",
      "text": "@{if(empty(triggerBody()?['deviceType']), '', concat('Device Type: ', triggerBody()?['deviceType']))}",
      "wrap": true
    },
    {
      "type": "TextBlock",
      "text": "@{if(empty(triggerBody()?['resourceType']), '', concat('Resource Type: ', triggerBody()?['resourceType']))}"
    },
    {
      "type": "TextBlock",
      "text": "Tenant UUID: @{triggerBody()?['tenantUUID']}"
    },
    {
      "type": "TextBlock",
      "text": "Alert ID: @{triggerBody()?['id']}"
    },
    {
      "type": "TextBlock",
      "text": "Occurrence Time: @{outputs('Compose')}"
    },
    {
      "type": "TextBlock",
      "text": "[Click here](@{triggerBody()?['alertURL']})",
      "wrap": true
    }
  ]
}

7. Set up an action to send test alert message if condition is false.

• Now, in true box click on + icon and search for ‘Post card in a chat or channel’
• Select Post as, Post in and Group chat name as per your need
• In Adaptive card, enter following json

{
  "type": "AdaptiveCard",
  "version": "1.4",
  "body": [
    {
      "type": "TextBlock",
      "text": "Webhook alert test"
    },
    {
      "type": "TextBlock",
      "weight": "Bolder",
      "size": "Medium",
      "text": "🚨 @{triggerBody()?['severity']} Alert"
    },
    {
      "type": "TextBlock",
      "text": "Device Type: @{triggerBody()?['deviceType']}"
    },
    {
      "type": "TextBlock",
      "text": "Subcategory: @{triggerBody()?['subcatecory']}"
    },
    {
      "type": "TextBlock",
      "text": "Alert Source: @{triggerBody()?['alertSource']}"
    },
    {
      "type": "TextBlock",
      "text": "Resource Type: @{triggerBody()?['resourceType']}"
    },
    {
      "type": "TextBlock",
      "text": "Name: @{triggerBody()?['name']}"
    },
    {
      "type": "TextBlock",
      "text": "Creator: @{triggerBody()?['creator']}"
    },
    {
      "type": "TextBlock",
      "text": "Tenant UUID: @{triggerBody()?['tenantUUID']}"
    },
    {
      "type": "TextBlock",
      "text": "Alert ID: @{triggerBody()?['id']}"
    },
    {
      "type": "TextBlock",
      "text": "Occurrence Time: @{outputs('Compose')}"
    }
  ]
}

• Following is the final flow chart.

  
• This URL requires no authentication, so adequate security measures need to be applied to protect it. 
• The webhook HTTP URL will look something like this:

https://prod-08.westus.logic.azure.com/workflows/389d5c7dc79547fa95526b23c12890b0/triggers/manual/paths/invoke?api-version=2016-06-01&sp=%2Ftriggers%2Fmanual%2Frun&sv=1.0&sig=zb7SnFVJL7x-evrPZaSaQ1BsV1NHCaSqUlWuLf1Kq6N

8. Configure the Webhook URL

• Copy the URL and configure IBM Storage Insights to send JSON data to this URL.

• Go to Storage insights page → settings → integrations → click on Add integration

9. Test the Webhook and Automation Rule

Once the workflow is configured, test the webhook by sending a sample request from IBM Storage Insights. Follow is a image of actual alert sent to chat.

Conclusion

By setting up an incoming webhook in Microsoft teams, we can seamlessly integrate with IBM Storage Insights to automate the creation and management of issues based on real-time alerts. This integration streamlines incident management workflows and helps ensure timely and efficient responses to critical incidents such as ransomware attacks.

Reference

https://community.ibm.com/community/user/blogs/ramakrishna-vadla/2025/01/21/evolution-of-ibm-storage-insights-from-insights-to

https://www.ibm.com/docs/en/storage-insights?topic=resources-creating-webhook-in-storage-insights

Blog Contributors

Ramakrishna Vadla (ramavadl@in.ibm.com)

Maheshwar Tigadi (maheshwar.tigadi@in.ibm.com)