Microsoft Teams message geoIP map data

Follow

Patrick Travers

• August 27, 2020 18:23

Just wondering if anyone had any success with sending a webhook over to MS Teams that included the map geoIP data?  For example, someone successfully logs on to an O365 account, but fails the 2FA challenge.  You can get the client IP address from the JSON via Microsoft app. 

0

• 

  Jay Schwegler

  • August 27, 2020 19:55

  Hi Patrick,

  If you are using our geo lookup operator against a set of IPs from the Teams logs, for example:

  | lookup latitude, longitude, country_code, country_name, region, city, postal_code from geo://location on ip = src_ip

  Any of those resulting geo fields can be output in the JSON payload with the {{Results.fieldname}} variable. So if you wanted to include all of the countries, you could use this sort of logic for the payload configuration.

  {
  "title": "Country",
  "value": "{{Results.country_name}}"
  } 

  https://help.sumologic.com/Manage/Connections-and-Integrations/Webhook-Connections/Set_Up_Webhook_Connections#payload-variables-for-scheduled-searches-logs-only

  ./Jay Schwegler

  0

  Comment actions Permalink
• 

  Patrick Travers

  • August 27, 2020 20:07

  I figured I could do something like that.  But I was hoping just to get the image of the map.  But I don't think it's really setup to do that from the looks of it.

  0

  Comment actions Permalink

Please sign in to leave a comment.