Send Alerts to Microsoft Teams from Shuffle

Taylor Walton

06-Feb-2026

Send Alerts to Microsoft Teams from Shuffle (HTTP POST + Adaptive Card)

This article explains how to send alert notifications from Shuffle to Microsoft Teams using the new Workflow-based webhook method in Teams and a simple HTTP POST action in Shuffle. The message format uses a Teams-compatible Adaptive Card.

Prerequisites

• Access to the target Microsoft Teams channel where alerts should be posted
• Access to Shuffle (workflow editor) and the variables you want to include (e.g., alert_title, alert_id, customer_code, asset_name)

Step 1 — Create the Microsoft Teams Webhook URL (Workflow Method)

Microsoft Teams has moved from the classic “Incoming Webhook” connector to a Workflow-based webhook method. Follow this SOCFortress knowledge base article to generate the webhook URL for your Teams channel:

How to Configure a Microsoft Teams Webhook Using the New Workflow Method

When finished, you will have a Teams-generated URL that looks similar to:

https://prod-XX.westus.logic.azure.com/workflows/XXXXXXXXXXXXX/triggers/manual/paths/invoke?api-version=1.0&sp=...&sv=...&sig=...

Important: Keep this URL secure. Anyone with the URL can potentially post messages to that channel (depending on your workflow configuration).

Step 2 — Build the Shuffle Workflow

2.1 Create a new Workflow

1. In Shuffle, create a new workflow (or open an existing one).
2. Add your preferred trigger (manual trigger for testing, webhook trigger, alert trigger, etc.).
3. Ensure the trigger (or earlier steps) populates these execution arguments:
   • $exec.execution_arguments.alert_title
   • $exec.execution_arguments.alert_id
   • $exec.execution_arguments.customer_code
   • $exec.execution_arguments.asset_name

2.2 Add the HTTP action (POST)

1. Add an HTTP node/action in the workflow.
2. Set Method to POST.
3. Set the URL to the Teams Workflow webhook URL you generated in Step 1.
4. Set the request header:
   • Content-Type: application/json

Step 3 — Configure the Request Body (Adaptive Card)

In the HTTP node body/payload, paste the JSON below exactly (no extra text before or after the JSON). This will post an Adaptive Card into Teams.

{
 "type": "message",
 "attachments": [
 {
 "contentType": "application/vnd.microsoft.card.adaptive",
 "contentUrl": null,
 "content": {
 "$schema": "http://adaptivecards.io/schemas/adaptive-card.json",
 "type": "AdaptiveCard",
 "version": "1.3",
 "body": [
 {
 "type": "TextBlock",
 "text": "TEST SIEM Stack Alert",
 "weight": "Bolder",
 "size": "Medium"
 },
 {
 "type": "TextBlock",
 "text": "Message: $exec.execution_arguments.alert_title",
 "wrap": true
 },
 {
 "type": "TextBlock",
 "text": "Alert ID: $exec.execution_arguments.alert_id",
 "wrap": true
 },
 {
 "type": "TextBlock",
 "text": "Customer Code: $exec.execution_arguments.customer_code",
 "wrap": true
 },
 {
 "type": "TextBlock",
 "text": "Asset Name: $exec.execution_arguments.asset_name",
 "wrap": true
 }
 ]
 }
 }
 ]
}

Notes

• All variables must stay inside the JSON string values (do not append variables after the closing brace).
• If any field value can contain quotes ("), make sure your upstream step sanitizes/escapes those values, or you may break JSON.

Step 4 — Test and Validate

1. Run the workflow in Shuffle (use a manual trigger first if available).
2. Confirm the message posts to the Teams channel.
3. If it fails, check the HTTP node output, including:
   • Request payload sent
   • HTTP status code / response body
   • Shuffle execution logs

Troubleshooting

SyntaxError: unterminated string literal

This almost always means the payload is not valid JSON. Common causes:

• You accidentally inserted variables outside JSON, e.g., } then $exec...
• You introduced unescaped quotes inside a JSON string, e.g., "text": "Message: "something""

Best practices to avoid JSON issues

• Keep the payload as pure JSON only (no extra characters before/after).
• If your message content can include quotes, escape them as \" before inserting, or ensure the producing step outputs safe JSON strings.
• Validate the JSON body before pasting if you’re editing it manually.

References

• SOCFortress KB: Teams Webhook (Workflow Method)
• Microsoft: Create incoming webhooks with Workflows for Teams
• Adaptive Cards Documentation