Alerts in Teams, by email and in Jira

Sorvek first shows its alerts under the bell icon in the console. You can also receive them in a Microsoft Teams channel, receive reports by email and create Jira tickets from findings. These settings are reserved for administrators.

Microsoft Teams

Teams receives one adaptive card per event, through the Teams Workflows app (Microsoft has retired the old Office 365 connectors).

1. In Teams, open the Workflows app and create a flow from the "Send webhook alerts to a channel" template.
2. Choose the team and the channel. Keep the trigger open to anyone: Sorvek does not send an authentication token.
3. Copy the URL generated by the flow.
4. In Sorvek, open Settings, then Integrations.
5. On the Microsoft Teams row, click Connect.
6. Enter a Channel name and paste the Webhook URL (HTTPS).
7. Check the Events to receive. If you check none, all events are sent.
8. Click Save channel, then Test.

Last delivery shows Accepted when Teams has received the message; check that it appears in the channel.

What the card contains

A title, a summary, up to 10 fields depending on the event and an Open in Sorvek button. For a new application: the vendor, the risk level, the First user (an employee's email address) and the date. All members of the channel see this information: choose the channel accordingly.

The events

Two alerts have no checkbox: a new AI application ("Shadow AI detected") and an access exception request sent from the extension, which contains the employee's email and their justification. Only channels with no event checked receive them.

Slack, Discord and a Generic webhook are set up the same way, on the same page.

By email

The Communication email, at the top of the Integrations page, receives the messages addressed to your organization. A shared mailbox or a distribution list works. If left empty, it defaults to the first administrator's email; the page shows the address actually used.

Two mailings are sent to it:

• after the first completed scan of a Microsoft 365 source, an email with the first scan report attached as a PDF;
• at the start of each month, the monthly report as a PDF: inventory figures, new applications, priority findings and identity lifecycle.

Other scans, and all scans of a Google Workspace source, are not sent by email: their summary arrives under the bell icon. The monthly report cannot be turned off from the console: to stop receiving it, write to contact@sorvek.com. Alerts set with Notify me on the OAuth permissions page (see OAuth grants) are personal and also arrive in your Sorvek inbox.

Jira

Connect Jira

1. Open Settings, then Connected apps.
2. On the Jira card, click Connect.
3. Fill in Jira site URL, Atlassian account email, Atlassian API token (created on id.atlassian.com, in the account's security settings), Project key (for example SEC) and, if needed, Ticket type (optional).
4. Click Connect at the bottom of the panel. Sorvek checks the account and the access to the project before saving.

The account must be able to create tickets in the project. Sorvek creates tickets and comments on them, and never deletes any.

Send findings

1. Open Risks, then Findings, and filter the list.
2. Click Send to Jira.
3. Read the preview: for each finding, Create a ticket, Comment (recurrence) or Already linked. A send covers 50 findings at most.
4. Click Confirm. The result gives the link to each ticket.

A finding gives a single ticket; if it comes back, Sorvek adds a comment. The severity becomes the priority (critical: Highest, high: High, medium: Medium, low: Low) and the ticket carries the sorvek label. It contains the title, the type, the severity, the details, up to 10 pieces of evidence (sometimes employee email addresses), the recommended fix and a link to Sorvek.

In the same preview, the "Automatically send new high and critical findings every night" box is unchecked by default. Findings linked to a breach are never sent automatically.