Incoming Webhook → Adaptive Card, themed by urgency. SMB table-stakes.
Where to get it
Your own Teams channel — an Incoming Webhook (or Workflows connector).
Install / what you need
No install. Create an Incoming Webhook on the target Teams channel.
How to connect
- 1 Add an Incoming Webhook to your Teams channel → copy the URL.
- 2 Open the dashboard's Notifications panel → Add destination → choose teams, fill in the URL.
- 3 Hit Send test on the destination card — renders an Adaptive Card.
When you'd use it
What Herald sends through this channel
2 setup fields
Herald hands every alert to the
TeamsAdapter
as a DispatchPlan. The fields
below are what the dashboard form asks for; the sample is the plan the adapter receives.
The adapter renders it into the channel-native shape (Discord embeds, Teams MessageCards,
PagerDuty Events-API payloads, TwiML, JSON POST bodies) on the way out — that wire transcript varies per channel.
Setup form fields
| field | type | required | description / default |
|---|---|---|---|
| webhook_url | string | required | MS Teams Incoming Webhook URL (channel → Connectors) |
| timeout_seconds | number | optional | no description · default: 10 |
Sample DispatchPlan (input to the adapter)
{
"decision_id": "tdc-2026-06-20-abc12",
"channel": "<channel-type>",
"recipient": {
"recipient_id": "soc-oncall",
"display_name": "SOC on-call",
"addresses": [
{
"channel": "<channel-type>",
"address": "<destination>",
"min_defcon": 5
}
]
},
"urgency": "high",
"retry_policy": {
"max_attempts": 3,
"initial_backoff_seconds": 5
},
"subject": "Suspicious login on CEO-LAPTOP",
"body": "Warden flagged a PowerShell child of WINWORD.EXE. The encoded command resolved to a base64-wrapped Invoke-WebRequest to a newly-registered domain. Trust ladder: L3.",
"approval_link": "https://app.cybercli.local/approve/abc12",
"incident_ref": "case-2026-0142",
"signal_id": "sig-2026-06-20-9f3"
} Sovereignty: byo_external · Min tier (BYO): pro · MS Teams Incoming Webhook (legacy connector format).
Posts to your Teams channel (Microsoft cloud). Webhook URL vault-stored.
Herald — the Guild's voice role — routes alerts, daily digests, and AI verdicts here, on a per-CYCON-state matrix you control. CYCON 1/2 alerts repeat until an operator acks.
The Guild →