Current ThreatQ Version Filter

Viva Engage (Yammer) Action

The web format of this guide reflects the most current release. Guides for older iterations are available in PDF format.

Integration Details

ThreatQuotient provides the following details for this integration:

Current Integration Version

1.0.0

Compatible with ThreatQ Versions

>= 5.20.0

ThreatQ TQO License Required

Yes

Support Tier

ThreatQ Supported

Introduction

The Viva Engage Action for ThreatQ will automatically create an Event Summary post in a Viva Engage (Yammer) Community, summarizing recent Events in ThreatQ. The action is configured to run on a schedule, posting a summary of all new Events from the provided ThreatQ Data Collection.

The integration provides the following action:

Viva Engage - Post Event Summary - creates a post for new ThreatQ Events in a Viva Engage (Yammer) Community.

The action is compatible with Event system objects.

This action is intended for use with ThreatQ TDR Orchestrator (TQO). An active TQO license is required for this feature.

Prerequisites

An active ThreatQ TDR Orchestrator (TQO) license.
A data collection containing the event object type.
An App Developer Token from a Viva Engage App. See the Generating a Viva Engage App Developer Token section below for details.

Generating a Viva App Developer Token

In order for this integration to authenticate with Viva Engage, an app needs to be created. This app will only be viewable and used by your organization. Below are steps on how to create the app and generate a developer token:

Log into your Viva Engage account.
Navigate to https://www.yammer.com/client_applications.
Click on the Register New App button.

Enter the details for your new app:

Field	Entry
Application Name	ThreatQ
Organization	ThreatQuotient
Support E-Mail	tq-support@securonix.com
Website	https://threatq.com
Redirect URI	https:://localhost

Yammer Setup - New App

Agree to the terms of service and click Continue.
On the Keys and tokens page, click Generate a developer token for this application
Copy and save the token to a secure location.
This is the key used for the integration.
(Optional) Click on App Directory and add some more details for the App.
You can find the icons for ThreatQ at https://threatq.com/branding.

Installation

Perform the following steps to install the integration:

The same steps can be used to upgrade the integration to a new version.

Log into https://marketplace.threatq.com/.
Locate and download the action zip file.
Navigate to the integrations management page on your ThreatQ instance.
Click on the Add New Integration button.
Upload the action zip file using one of the following methods:
- Drag and drop the zip file into the dialog box
- Select Click to Browse to locate the zip file on your local machine
ThreatQ will inform you if the action already exists on the platform and will require user confirmation before proceeding. ThreatQ will also inform you if the new version of the action contains changes to the user configuration. The new user configurations will overwrite the existing ones for the action and will require user confirmation before proceeding.

You will still need to configure the action.

Configuration

ThreatQuotient does not issue API keys for third-party vendors. Contact the specific vendor to obtain API keys and other integration-related credentials.

To configure the integration:

Navigate to your integrations management page in ThreatQ.
Select the Actions option from the Category dropdown (optional).
Click on the action entry to open its details page.

Enter the following parameters under the Configuration tab:

The configurations set on this page will be used as the default settings when inserting this action into a new workflow. Updating the configurations on this page will not update any instances of this action that have already been deployed to a workflow. In that scenario, you must update the action’s configurations within the workflow itself.

Parameter	Description
App Developer Token	The Developer Token for the ThreatQ Application created in Viva Engage (Yammer).
Viva Engage Community (Group) Name	The name of the group that you'd like the alerts posted.
Viva Engage Community (Group) ID	The ID of the group that you'd like the alerts posted.
ThreatQ Hostname / IP	The Hostname or IP you use to access your ThreatQ instance. This is for linking back to ThreatQ.
Objects Per Run	The maximum number of objects to process per run of the workflow.

Review any additional settings, make any changes if needed, and click on Save.

Actions

The integration provides the following action:

Action	Description	Object Type	Object Subtype
Viva Engage - Post Event Summary	Creates a post in Viva Engage summarizing recent ThreatQ Events.	Event	N/A

Viva Engage - Post Event Summary

The Viva Engage - Post Event Summary action creates a post in a Viva Engage (Yammer) Community, summarizing recent Events in ThreatQ. The action is configured to run on a schedule, posting a summary of all new Events from the provided ThreatQ Data Collection. Each post will contain the titles, descriptions, sources, and links to the Events in ThreatQ.

First Request

The first request made will get the group ID for the provided group name. This is done by making a GET request to the following URL below.

GET https://www.yammer.com/api/v1/groups.json

Sample Response:

[
  {
    "type": "group",
    "id": 159014699008,
    "email": "threatq+example.onmicrosoft.com@yammer.com",
    "full_name": "ThreatQ",
    "network_id": 117834719232,
    "name": "threatq",
    "description": "ThreatQ",
    "privacy": "public",
    "url": "https://www.yammer.com/api/v1/groups/159014699008",
    "web_url": "https://www.yammer.com/example.onmicrosoft.com/#/threads/inGroup?type=in_group&feedId=159014699008",
    "mugshot_url": "https://mugshot0.assets-yammer.com/mugshot/images/group_profile.png?P1=1695140376&P2=104&P3=1&P4=IakTX7P9UbG8ZarJn0PEJHaAo5Y5cnrv05U3_N-uiRDKogHb1tNwlM7vO07NrI81VwB8qqWXvjx2PQii9796WXGcgcSmWZCy38VVrnclvppzO70XD5r37a6A4OVEgobHZIfUq4jlUQ2tbWxhOReewa0c3QvXKEuErLKdhK5vZOecCsTotr5QRbsQKxOpzoIziJYfT7B93bmxIgt7lqibYU3gOEnbBQ5DOPagv6pnjbNwWe1-amHN3iOBIDTdW87lxkQHbtpw_cW6HyPdHdkKO5I3f7bRFFUHpzhbspKjkTLdOLnMshjOjP0fQoawqZfCRqIdCcw2TP57vChWOdMXsA&size=48x48",
    "mugshot_redirect_url": "https://www.yammer.com/mugshot/images/redirect/48x48/group_profile.png",
    "mugshot_url_template": "https://mugshot0.assets-yammer.com/mugshot/images/group_profile.png?P1=1695140376&P2=104&P3=1&P4=IakTX7P9UbG8ZarJn0PEJHaAo5Y5cnrv05U3_N-uiRDKogHb1tNwlM7vO07NrI81VwB8qqWXvjx2PQii9796WXGcgcSmWZCy38VVrnclvppzO70XD5r37a6A4OVEgobHZIfUq4jlUQ2tbWxhOReewa0c3QvXKEuErLKdhK5vZOecCsTotr5QRbsQKxOpzoIziJYfT7B93bmxIgt7lqibYU3gOEnbBQ5DOPagv6pnjbNwWe1-amHN3iOBIDTdW87lxkQHbtpw_cW6HyPdHdkKO5I3f7bRFFUHpzhbspKjkTLdOLnMshjOjP0fQoawqZfCRqIdCcw2TP57vChWOdMXsA&size={width}x{height}",
    "mugshot_redirect_url_template": "https://www.yammer.com/mugshot/images/redirect/{width}x{height}/group_profile.png",
    "mugshot_id": null,
    "show_in_directory": "true",
    "created_at": "2023/09/18 19:10:29 +0000",
    "aad_guests": 0,
    "color": "#0e4f7a",
    "external": false,
    "moderated": false,
    "header_image_url": "https://mugshot0.assets-yammer.com/mugshot/images/group-header-megaphone.png?P1=1695139983&P2=104&P3=1&P4=S5mKO8qCIS406O0jFrG2EPUA_VWgjOyOoGd46W4YRrg7lwmSQpxDhGRQBqpBfWlA5pTBFKpZgc-lJ78YFqBI5T-CRVof6Zv5y8YmH1R8H_E6l8HpGaSTTrCw0uefbTuwkHlNcsdO6PiFFE5cRVTH15X3joUVgYeR7kkrDg01I87S5Jm7kmnjULzcDGGNLtfxHfqJoWx1G2oIkblGxpYqg-2CRSg9DVNoZKFNzq1mUCG4Upuq24eU1XeU_pTn1mstVO19KRJ3TGKEaiIoQCg0wk8GPnZa4Arj44iSSlIe_tSjd-Bec4Gunk5ifU4aaMYXtuJFxht-IPuDCI4Xqev-0A",
    "category": "unclassified",
    "default_thread_starter_type": "normal",
    "restricted_posting": false,
    "company_group": false,
    "creator_type": "user",
    "creator_id": 3344976904192,
    "state": "active",
    "stats": {
      "members": 1,
      "aad_guests": 0,
      "updates": 0,
      "last_message_id": 2451038408105984,
      "last_message_at": "2023/09/18 19:11:13 +0000"
    }
  }
]

Post to Viva Engage

The next request will actually create the post in Viva Engage.

POST https://www.yammer.com/api/v1/messages.json

Sample Response:

{
  "threaded_extended": {},
  "messages": [
    {
      "id": 2452236592660480,
      "sender_id": 3344976904192,
      "delegate_id": null,
      "replied_to_id": null,
      "created_at": "2023/09/19 15:01:31 +0000",
      "published_at": "2023/09/19 15:01:31 +0000",
      "network_id": 117834719232,
      "message_type": "update",
      "sender_type": "user",
      "url": "https://www.yammer.com/api/v1/messages/2452236592660480",
      "web_url": "https://www.yammer.com/example.onmicrosoft.com/messages/2452236592660480",
      "group_id": 159014699008,
      "body": {
        "parsed": "test",
        "plain": "test",
        "rich": "test"
      },
      "thread_id": 2452236592660480,
      "client_type": "ThreatQ",
      "client_url": "https://threatquotient.com",
      "system_message": false,
      "direct_message": false,
      "chat_client_sequence": null,
      "language": null,
      "notified_user_ids": [],
      "privacy": "public",
      "attachments": [],
      "liked_by": {
        "count": 0,
        "names": []
      },
      "supplemental_reply": false,
      "content_excerpt": "test",
      "group_created_id": 159014699008
    }
  ],
  "references": [
    {
      "type": "user",
      "id": 3344976904192,
      "name": "zachshames",
      "state": "active",
      "full_name": "Zach Shames",
      "job_title": "",
      "network_id": 117834719232,
      "mugshot_url": "https://mugshot0.assets-yammer.com/mugshot/images/LLv2hrmGf0GQCzM0X3MhhXQF9X14FdmF_27df653f-2337-4da3-8f4d-3505fad725b8?P1=1695140067&P2=104&P3=1&P4=Przqtft2f56CO2EfBgsmrPaSdr4kSk1N0myDZ5oTp9EmiXXvN7_MEhH495UsGBmVDvr6SDw35_wPM-oqPKTwP3OYZN5VOh3_m2rgVCR_hhl7JMklPU8_eDxKsTH0TixXm7Xe3YBfmVQgra--3RgsSI28G9kM35eR-qs6kk80sBSWqHEOVnkNz67fb9Y_tKeh_0bSYyJK0aoO_PtHL3YQMwZQ_r4b-AkPY-FLgui0IuLbNSVOCiYeKzVtaqx_WvG9FqT6ImUgrjF3lamN4orIPJWUrFWAhQkH4zyc32SBHFo1u0Os4zbwPTR-YDGJIyLoUGIKaXMR1FiqkgjAT4jQ8A&size=48x48",
      "mugshot_redirect_url": "https://www.yammer.com/mugshot/images/redirect/48x48/LLv2hrmGf0GQCzM0X3MhhXQF9X14FdmF_27df653f-2337-4da3-8f4d-3505fad725b8",
      "mugshot_url_template": "https://mugshot0.assets-yammer.com/mugshot/images/LLv2hrmGf0GQCzM0X3MhhXQF9X14FdmF_27df653f-2337-4da3-8f4d-3505fad725b8?P1=1695140067&P2=104&P3=1&P4=Przqtft2f56CO2EfBgsmrPaSdr4kSk1N0myDZ5oTp9EmiXXvN7_MEhH495UsGBmVDvr6SDw35_wPM-oqPKTwP3OYZN5VOh3_m2rgVCR_hhl7JMklPU8_eDxKsTH0TixXm7Xe3YBfmVQgra--3RgsSI28G9kM35eR-qs6kk80sBSWqHEOVnkNz67fb9Y_tKeh_0bSYyJK0aoO_PtHL3YQMwZQ_r4b-AkPY-FLgui0IuLbNSVOCiYeKzVtaqx_WvG9FqT6ImUgrjF3lamN4orIPJWUrFWAhQkH4zyc32SBHFo1u0Os4zbwPTR-YDGJIyLoUGIKaXMR1FiqkgjAT4jQ8A&size={width}x{height}",
      "mugshot_redirect_url_template": "https://www.yammer.com/mugshot/images/redirect/{width}x{height}/LLv2hrmGf0GQCzM0X3MhhXQF9X14FdmF_27df653f-2337-4da3-8f4d-3505fad725b8",
      "url": "https://www.yammer.com/api/v1/users/3344976904192",
      "web_url": "https://www.yammer.com/example.onmicrosoft.com/users/3344976904192",
      "activated_at": "2023/09/11 14:21:02 +0000",
      "auto_activated": false,
      "stats": {
        "following": 0,
        "followers": 0,
        "updates": 0
      },
      "email": "zach.shames@example.onmicrosoft.com",
      "aad_guest": false
    },
    {
      "url": "https://www.yammer.com/api/v1/messages/in_thread/2452236592660480",
      "web_url": "https://www.yammer.com/example.onmicrosoft.com/threads/2452236592660480",
      "type": "thread",
      "id": 2452236592660480,
      "network_id": 117834719232,
      "thread_starter_id": 2452236592660480,
      "group_id": 159014699008,
      "topics": [],
      "privacy": "public",
      "announcement": false,
      "direct_message": false,
      "has_attachments": false,
      "reply_disabled": false,
      "stats": {
        "first_reply_id": null,
        "first_reply_at": null,
        "latest_reply_id": 2452236592660480,
        "latest_reply_at": "2023/09/19 15:01:31 +0000",
        "updates": 1,
        "shares": 0
      },
      "invited_user_ids": [],
      "read_only": false,
      "can_mark_best_reply": false
    },
    {
      "type": "group",
      "id": 159014699008,
      "email": "threatq+example.onmicrosoft.com@yammer.com",
      "full_name": "ThreatQ",
      "network_id": 117834719232,
      "name": "threatq",
      "description": "ThreatQ",
      "privacy": "public",
      "url": "https://www.yammer.com/api/v1/groups/159014699008",
      "web_url": "https://www.yammer.com/example.onmicrosoft.com/#/threads/inGroup?type=in_group&feedId=159014699008",
      "mugshot_url": "https://mugshot0.assets-yammer.com/mugshot/images/group_profile.png?P1=1695069576&P2=104&P3=1&P4=qSM2v70-P3XyElXqI5EdMBcZ3LCU50b2jMIOWlI76MiONH7WfYyW_i02Zx4pCtw-SH01Q9srmhwllTfnQNLHXNQmsx5ESzQ7ECsjnOcW3WBzWiaYxKjjAam9Uyj2xK_hbi_s9n_FCn59kRD7Gl77kTs2CHbiDPhc5klp6clmQQJMYK4ce8IKzOHsrmMSRjEGXsABirb2LtCEpL5amljEro5od1zR91836Mmk7pNqXdFpyvgwWw9SVcEFlAUtKSCmqSo2XxnsDQd2XJsp_F4pYdFitmVMV0a3wo1wRdhT3Ob8cuDZa78jRCUOtHoc8DflZLMXd0dsmJ4wmvdK0A13gw&size=48x48",
      "mugshot_redirect_url": "https://www.yammer.com/mugshot/images/redirect/48x48/group_profile.png",
      "mugshot_url_template": "https://mugshot0.assets-yammer.com/mugshot/images/group_profile.png?P1=1695069576&P2=104&P3=1&P4=qSM2v70-P3XyElXqI5EdMBcZ3LCU50b2jMIOWlI76MiONH7WfYyW_i02Zx4pCtw-SH01Q9srmhwllTfnQNLHXNQmsx5ESzQ7ECsjnOcW3WBzWiaYxKjjAam9Uyj2xK_hbi_s9n_FCn59kRD7Gl77kTs2CHbiDPhc5klp6clmQQJMYK4ce8IKzOHsrmMSRjEGXsABirb2LtCEpL5amljEro5od1zR91836Mmk7pNqXdFpyvgwWw9SVcEFlAUtKSCmqSo2XxnsDQd2XJsp_F4pYdFitmVMV0a3wo1wRdhT3Ob8cuDZa78jRCUOtHoc8DflZLMXd0dsmJ4wmvdK0A13gw&size={width}x{height}",
      "mugshot_redirect_url_template": "https://www.yammer.com/mugshot/images/redirect/{width}x{height}/group_profile.png",
      "mugshot_id": null,
      "show_in_directory": "true",
      "created_at": "2023/09/18 19:10:29 +0000",
      "members": 1,
      "aad_guests": 0,
      "color": "#0e4f7a",
      "external": false,
      "moderated": false,
      "header_image_url": "https://mugshot0.assets-yammer.com/mugshot/images/group-header-megaphone.png?P1=1695069183&P2=104&P3=1&P4=eVdbiFWTRGq40TthQ4f2wR6j-PjM4SJ3_8JjB6taFmmIfnIo52Vy5b-9jws0617StmNY8NOxsOz-paB6v_QnaItnyB5oWLXS8byiizWzQLPMMHrj0zv7GIwX-X7_w3z675YH371yoU1ibWoBjmhCsLXE5R8JFVl-pxb_q2X9z2VhiHqN9gYPM9vXDfdrJUmPDf10HfW-sjyZTtgzvaYhz9WTPtLVpzSyDvtPCHuw5lZXqIJymH-qKIzlCMI7NikyG97aKD27s7MKaRgbDayQeYiRhMd9bE_tKhbS2vklo3tzc-ER8FVA04mh9sECy8-bwD7t3IwlBJrH_pxqar7pAQ",
      "category": "unclassified",
      "default_thread_starter_type": "normal",
      "restricted_posting": false,
      "company_group": false
    }
  ],
  "external_references": [],
  "meta": {
    "older_available": false,
    "requested_poll_interval": 60,
    "last_seen_message_id": null,
    "current_user_id": 3344976904192,
    "followed_references": [],
    "ymodules": [],
    "newest_message_details": null,
    "feed_name": "Unknown Feed",
    "feed_desc": "This feed is not known.",
    "direct_from_body": false
  }
}

Known Issues / Limitations

Due to how Viva Engage handles authentication, posts will be made by the user who provisioned the App Developer Token.
Viva Engage does not support HTML or Markdown formatting when creating posts via the API.
Viva Engage has a message length limit of 10k characters. Some posted messages may be truncated due to this limitation.

Change Log

Version 1.0.0
- Initial release

PDF Guides

Document	ThreatQ Version
Viva Engage (Yammer) Action Guide v1.0.0	5.20 or Greater