How to Route Splunk Alerts to Microsoft Teams (and Slack) in Real Time

Splunk Alert Routing in Mixed-Platform Environments

Splunk's alert actions system supports Slack natively via the Splunk App for Slack. For security operations centers and DevOps teams running entirely on Slack, this covers the notification use case.

But enterprise security teams increasingly span multiple platforms. SOC analysts may run in Slack or Teams. CISO and security leadership almost universally use Teams in Microsoft 365 organizations. For compliance alerts that need to reach both technical responders and executive stakeholders, Splunk's native Slack integration is insufficient.

Splunk has no native Microsoft Teams integration as a built-in alert action. Teams can be reached via webhook URL in a generic webhook alert action, but this requires manual JSON payload construction and separate alert configuration per destination. Organizations with dozens of Splunk alert rules face a combinatorial maintenance problem.

Routing Architecture

The clean architecture is to route Splunk alert actions through a single endpoint that handles fan-out. Configure Splunk's webhook alert action to POST to SyncRivo. SyncRivo receives the Splunk alert payload, normalizes it, and distributes to configured destinations — Slack channels, Teams channels, Webex spaces, Google Chat rooms, or Zoom channels — according to routing rules.

One Splunk alert rule → one SyncRivo endpoint → multiple platform destinations.

Setup (20 minutes):

1. Connect Slack and Teams to SyncRivo via OAuth.
2. Create a Webhook source in SyncRivo. Copy the endpoint URL.
3. In Splunk, navigate to the alert you want to route. Edit the alert actions. Add a "Webhook" action. Set the URL to your SyncRivo endpoint.
4. In SyncRivo, configure routing: critical severity alerts to both Slack #security-incidents and Teams #soc-alerts; high severity to Slack only; compliance alerts to a Teams channel for the compliance team.
5. Repeat for each Splunk alert rule. All route to the same SyncRivo endpoint — routing differentiation happens in SyncRivo, not in Splunk.

Security Event Routing by Audience

Critical security events (brute force detected, privilege escalation, data exfiltration indicators): Route to both Slack and Teams simultaneously. The SOC analyst on Slack and the security manager on Teams both need to see this immediately.

Compliance violations (policy breach, failed access audit): Route to a dedicated Teams channel monitored by the compliance team. These events require documentation and response, not just operational awareness.

System health alerts (index performance, forwarder connectivity): Route to Slack for the engineering team. These are operational rather than security events.

Threat intelligence matches: Route to both platforms with enriched context — matched indicator, confidence score, affected system. Security analysts on both platforms can begin investigation without switching tools.

The key advantage over configuring per-platform Splunk webhooks: routing logic is centralized. When you add a new Slack channel or a new Teams team, you update SyncRivo — not dozens of Splunk alert rules.

For the full routing matrix and Splunk webhook payload mapping, see the Splunk Alerts in Slack & Teams integration guide.