Custom JSON Webhook for Teams showing search results

[MemK1]

Hi All,
Does anyone know if its possible to send a custom webhook payload to teams that also includes the search results (or the top 10 at least ?)
I have webhooks working without search results and using openuri for the potential actions in the Teams Customer JSON Payload for the azure alert, just tried many ways for the JSON Table that is sent in the payload when

"IncludeSearchResults": true

I have been playing with this -

{
"alertname":"AcmeRule","IncludeSearchResults":true,
"SearchResults":
{
"tables":[
{"name":"PrimaryResult","columns":
[
{"name":"$table","type":"string"},
{"name":"Id","type":"string"},
{"name":"TimeGenerated","type":"datetime"}
],
"rows":
[
["Fabrikam","33446677a","2018-02-02T15:03:12.18Z"],
["Contoso","33445566b","2018-02-02T15:16:53.932Z"]
]
}
]
},
"@context": "http://schema.org/extensions",
"@type": "MessageCard",
"themeColor": "CC4216",
"title": "#alertrulename",
"text": "#alertrulename returned #searchresultcount records which exceeds the threshold of #thresholdvalue .",
"potentialAction": [{
"@type": "OpenUri",
"name": "See details in AppInsights",
"targets": [{
"os": "default",
"uri": "#linktosearchresults"
}]
}],
"sections": [{
"facts": [{
"name": "Severity:",
"value": "#severity"
},
{
"name": "ResultCount:",
"value": "#searchresultcount"
},
{
"name": "Search Interval StartTime:",
"value": "#searchintervalstarttimeutc"
},
{
"name": "Search Interval End time:",
"value": "#searchintervalendtimeutc"
}]
}]
}
Thanks

[#2]

@MemK1 

I've come here seeking an answer to the same question and am hoping to bump this for the OP, myself, and others.

We are also attempting to use the MessageCard in Teams as we use it for a LOT of things and it works great. However, for Alerts with a limited result set I want the results included. We've included the

"IncludeSearchResults":true,

and done so as a top-level property in the custom JSON payload. While we get our expected card in the target Teams channel when the Alert Rule fires we do not get the expected results.

While you can include #variables using the "hashtag" format -- for which we assume they pre-processing the payload and performing text-replacement on your JSON before it is sent, and which makes perfect sense. 

What is a whole lot less clear is why we are asked to include a specific key-value pair in a payload intended for the ultimate recipient of the JSON. Why are we not simply asked to use #searchResults so their pre-processing of the payload can insert the table?

On the above basis I think either the documentation is incorrect on this one or woefully unclear -- but I'm all ears to anyone who might be able to demystify what's meant to be going on here.

[#3]

@Avid_Azure_User To get the context of the alert in the payload we recommend using dimensions, not relaying on the search results. This will provide you with the pairs you need.

Overall include search results is best effort and is not means to get context of the alerts. To get the full results provide the links in the payload.

[#4]

@MemK1 I've done this as follows: Create a PowerShell script in an Azure Automation account that reads out data from the alert, then create a webhook for this runbook (technically this script could also be in an Azure function). Create an Action Group with a Webhook as action, pointing the webhook of the runbook you've created. Make sure you have "Common Alert Schema" enabled in the Action Group, otherwise you go nuts trying to process the different alerts. At the end of the PowerShell script once you've processed the json payload, use the PSTeams module to send your alert to Teams (I've even gone so far as to check the severity of the alert, and severity 0 goes to an on-call phone with more detailed info than what the normal SMS alerts give). Last but not least of course, set up your alert and set the Action Group as the target.

In order to process the json payload, I've used webhook.site to make more sense of what alert gives what type of output. If you set the URL given by webhook.site in the Action Group, whenever an alert triggers, the webhook data will be sent to that website and you're able to see a full example for different types of alerts.

I can't give you actual code, but let's just say to begin with this as code:

param
(
[object] $WebhookData
)

$WebhookBody = ConvertFrom-Json -InputObject $WebhookData

I hope this helps.