HttpPOST Action

[dimarra]

What is the suggested way to implement the HttpPOST Action such that the activity on MSTeams is sent back to splunk? Can you provide guidance? Thanks

[guilhemmarchand]

@dimarra

Unfortunately I could never test this configuration myself due to lack of an MS teams access post development, this is covered in the MS doc:

https://docs.microsoft.com/en-us/outlook/actionable-messages/message-card-reference

In theory, you should be able to provide the relevant information for Teams to achieve a REST call back on something when the user clicks on the button.

I will be happy to make changes if you find issues or enhancements required on this

[dimarra]

thanks for the prompt response.

The link you have provided leads to the Card Playground which provides a sample json to for "@type": "MessageCard",. I know I need to customize this json per my needs. Where do I set this in my search/alert?

[dimarra]

I would like to have a drop down list in the message card. However it appears that this add on does not support Action Card of Type MultichoiceInput.

Is there a way to get a field that allows to stick in json for the potentialAction field to have more control in there?

	{
		"@type": "ActionCard",
		"name": "Move",
		"inputs": [
			{
				"@type": "MultichoiceInput",
				"id": "move",
				"title": "Pick a list",
				"choices": [
					{
						"display": "List 1",
						"value": "l1"
					},
					{
						"display": "List 2",
						"value": "l2"
					}
				]
			}
		],
		"actions": [
			{
				"@type": "HttpPOST",
				"name": "OK",
				"target": "http://..."
			}
		]
	},

[guilhemmarchand]

@dimarra
I will have a look, I could provide a free text form option where to paste a JSON structure yes, this might gets somehow challenging to include dynamic content resulting from the Splunk search (ex: $result,my_splunk_field$) but this should be possible as I believe I am doing this already in my JIRA Add-on.
Leave this with me, I will drop a message here if I have more questions