User Guide: MS Teams Notifications for Physical Security Incidents

User Guide: MS Teams Notifications for Physical Security Incidents 

Release: 1.4.0

Overview 

The MS Teams Notification system automatically sends a message to your Microsoft Teams channel whenever a new Physical Security Incident (PSI) or Physical Security Operation (PSO) is created in the SOC Workspace. The message includes the incident number as a clickable link so your team can access the record immediately from Teams. 

What This Feature Does 

• Automatic notifications: Your Teams channel is notified the moment a new PSI or PSO is created 

• Targeted routing: Messages go to the specific Teams channel mapped to the assignment group on the incident 

• Clickable links: The incident number in the Teams message links directly to the record in SOC Workspace 

• No manual action needed: Notifications are sent automatically - team members do not need to check the workspace for new incidents 

For SOC Operators: Receiving Notifications 

When a new PSI is created and assigned to your group, your designated Teams channel will receive a message in this format: 

A new incident PSI0012345 has been created and assigned to your group. 

Short Description: Tailgate incident reported at Building 5 North entrance 

To access the incident from Teams: 

1. Locate the notification in your Teams channel 

1. Click the incident number (shown as a blue hyperlink, e.g., PSI0012345) 

1. Your browser opens directly to the full incident record in SOC Workspace 

1. You may be prompted to log in if you are not already authenticated 

1. Begin working the incident immediately 

For SOC Administrators: Setting Up Notifications 

Step 1: Set Up MS Teams Channel Mappings 

1. Navigate to the MS Teams App Channels table in ServiceNow 

1. For each Teams channel that should receive notifications, create or open a channel record 

1. Fill in the required fields: 

• Channel Name: Name of your Teams channel 

• Channel ID: The Microsoft Teams channel identifier 

• Webhook URL: The incoming webhook URL from Teams 

• Assignment Group: The security assignment group to map to this channel 

1. Click Save 

1. Repeat for each channel/group combination 

Step 2: Verify the Notification Flow 

1. Navigate to Flow Designer 

1. Locate the PSI notification flow 

1. Confirm the flow is Active 

1. Run a test by creating a test PSI and verifying the notification appears in the expected Teams channel 

Configuration Notes 

• Each assignment group can be mapped to one Teams channel 

• Notifications trigger when a new PSI or PSO is created - not on updates 

• The notification includes the incident number (as a link), assignment notice, and short description 

• No end-user configuration is required - once set up by an administrator, notifications work automatically for all team members in the mapped channel