The integration connects these environments through Microsoft Power Automate. Sycope sends alert data to a webhook, Power Automate processes the received information and publishes it in the selected Teams channel as an Adaptive Card.
The notification can include the alert name, severity, rule type, timestamp, threshold level, Client IP and Server IP, together with a direct link to the corresponding alert in Sycope. The presentation can also change dynamically according to alert severity, making higher-priority events easier to identify in the channel.
Table of Contents
From a Sycope alert to a Teams channel
Alerts can be sent to Microsoft Teams manually or automatically.
An analyst can select an active alert in Sycope and send it through the configured REST Client. For recurring operational workflows, the same integration can be assigned directly to a Sycope rule, with selected threshold levels determining when the external action should be executed.
Sycope sends the alert data as JSON to a webhook created in Power Automate. The flow parses the incoming information and uses it to populate an Adaptive Card that is posted in the appropriate Teams channel.
The card provides the team with the main information required for an initial assessment without attempting to reproduce the complete Sycope investigation view inside Teams.
A View in Sycope button links directly to the relevant alert. The integration can also be configured with links to other Sycope dashboards or with multiple buttons when different investigation paths are useful for a particular workflow.
Complementary capabilities, clearly divided
Sycope and Microsoft Teams remain independent platforms and cover different parts of the operational process.
Sycope provides:
- Flow-based network analysis
- Network performance monitoring
- Network anomaly and threat detection
- Predefined and custom alerting rules
- Historical network communication data
- Dashboards and analytical context
- Detailed information for further investigation
Microsoft Teams provides:
- Team communication channels
- Shared operational workspaces
- Notifications delivered through Power Automate
- Adaptive Cards for structured alert presentation
- Conversation and collaboration around operational events
Sycope remains responsible for monitoring, detection and analysis. Teams provides an additional communication layer in which selected events can be brought to the attention of the people responsible for responding to them.
Alert context available in Teams
The Adaptive Card provided in the Sycope integration repository uses information received directly from the Sycope alert.
The example includes the alert name, severity, rule type, timestamp, threshold level, Client IP and Server IP. A direct link connects the notification with the corresponding alert view in Sycope.
Power Automate logic can also modify the appearance of the card according to severity. In the provided configuration, Critical and High alerts use an attention style, Medium alerts use a warning style, and lower-severity information can be presented differently. Severity is also represented within the content of the card itself.
This helps teams distinguish higher-priority events when multiple notifications appear in the same channel.
The Adaptive Card can be modified if another set of alert fields, labels or visual elements is more appropriate for a particular team.
Bringing selected alerts into the operational workflow
The integration is most useful when Teams is treated as a notification and coordination layer rather than another monitoring console.
Notifications for NOC and SOC channels
Different Sycope rules can be associated with external actions according to their operational importance.
A NOC channel can receive selected network performance events, while a SOC-oriented channel can be used for security and anomaly alerts. Threshold levels determine which occurrences should generate an external notification.
This allows teams to keep the Teams feed focused on events that require attention instead of forwarding every alert generated in Sycope.
Initial assessment without opening another tool
The Adaptive Card provides enough information to understand the nature of the event before beginning a deeper investigation.
Alert severity, rule information, time and the client and server involved can help an engineer assess whether the event requires immediate attention and identify the systems affected.
When additional context is needed, the user can open the corresponding Sycope alert directly from the card.
Team coordination around the event
Once the alert appears in Teams, the responsible team can discuss it using the communication workflow already established in the channel.
The notification becomes a shared reference point for coordinating ownership and next steps, while detailed analysis continues in Sycope.
This separation keeps collaboration in Teams without moving the underlying monitoring and investigation process away from Sycope.
A ready, documented integration
The Microsoft Teams integration is available in the Sycope public GitHub repository.
The repository contains step-by-step configuration instructions and a ready-to-use adaptivecard.json file for the Teams notification.
The documented configuration has been verified with:
- Sycope 3.2 or later
- Microsoft 365 Business Basic or higher
The integration uses Microsoft Power Automate to receive the Sycope webhook, parse the alert payload and publish the resulting Adaptive Card in Teams.
Microsoft also currently recommends the Workflows approach for receiving webhook requests in Teams. Workflows are powered by Power Automate and can process an incoming HTTP request before posting a message or Adaptive Card to a channel or chat.
How the integration works
The integration consists of four main elements.
Teams channel and Power Automate webhook
A Team and channel are selected for receiving Sycope notifications.
A Power Automate flow is then created using a webhook-based Teams workflow. The flow generates an HTTP endpoint that can receive requests from an external system.
Access to the webhook can also be restricted to selected accounts according to the organization’s requirements.
External Destination in Sycope
The Power Automate webhook is configured in Sycope under External Destinations using the REST Client.
Sycope sends the alert information to the webhook using an HTTP POST request.
The configuration includes the Power Automate endpoint and its required query parameters.
Alert parsing and Adaptive Card
Power Automate receives the JSON alert generated by Sycope and parses its structure.
The parsed values are then used to populate the Adaptive Card supplied in the Sycope integration repository.
The card dynamically displays information such as severity, threshold, time, Client IP and Server IP. Power Automate expressions can also adjust visual elements according to the values received in the alert.
The flow additionally builds a URL containing the Sycope alert ID. This URL is assigned to the View in Sycope button so that the user can move directly from Teams to the relevant alert.
Manual or automatic alert delivery
The integration can be used manually from the context menu or configured as an action within a Sycope rule.
For automatic delivery, administrators select the Third-party system REST action, the configured external destination and the threshold levels that should trigger the notification.
Once these conditions are met, new alerts are automatically posted to the selected Teams channel.
From detection to team response
Consider a Sycope rule that detects network activity requiring operational attention.
When the rule reaches one of the configured threshold levels, Sycope sends the alert data to the Power Automate webhook.
The flow parses the alert and creates an Adaptive Card containing the event name, severity, timing information and the Client and Server IP addresses involved. The card is posted in the selected Microsoft Teams channel, with its appearance reflecting the severity of the event.
The team can use this information for an initial assessment and coordinate the next steps in the channel.
When an engineer needs to examine the network activity in more detail, the View in Sycope button opens the corresponding alert in Sycope, where the investigation continues with the available traffic history, dashboards and analytical context.
This keeps detection and network analysis in Sycope while making selected alerts immediately available within the team’s existing communication workflow.
Microsoft Teams integration with Sycope
The Sycope–Microsoft Teams integration connects network monitoring with an established team communication workflow.
Selected network, performance and security alerts can be delivered automatically as structured Adaptive Cards, prioritized visually according to severity and linked directly to the corresponding data in Sycope.
Want to include Sycope alerts in your Microsoft Teams workflow? Talk to our team.
