How to Route Splunk Alerts to Microsoft Teams (and Slack) in Real Time

Splunk Alerting in Mixed-Platform Environments

Splunk's alert actions system supports Slack natively via the Splunk App for Slack. For security operations centers and DevOps teams running entirely on Slack, this covers the notification use case.

But enterprise security teams increasingly span multiple platforms. SOC analysts may run in Slack or Teams. CISO and security leadership almost universally use Teams in Microsoft 365 organizations. For compliance alerts that need to reach both technical responders and executive stakeholders, Splunk's native Slack integration is insufficient.

Splunk has no native Microsoft Teams integration as a built-in alert action. Teams can be reached via webhook URL in a generic webhook alert action, but this requires manual JSON payload construction and separate alert configuration per destination. Organizations with dozens of Splunk alert rules face a combinatorial maintenance problem.

Notification Architecture

There is no single-endpoint shortcut through SyncRivo: it does not accept Splunk webhook alert actions, does not normalize or route alert payloads, and does not relay messages posted by bots or apps. The workable patterns are:

1. Splunk App for Slack for Slack, Teams-side webhook for Teams. Add a "Webhook" alert action pointing at a Teams Workflows or incoming-webhook flow that formats the Splunk payload.
2. One relay you host. Point every Splunk webhook alert action at a small service you run that applies your severity policy and posts to Slack and Teams. This centralizes the fan-out logic in one place you control.

Setup (pattern 1):

1. Install the Splunk App for Slack and connect the workspace.
2. Create a Teams Workflows or incoming-webhook flow for #soc-alerts and one for the compliance channel; copy the URLs.
3. In Splunk, navigate to the alert you want to send. Edit the alert actions. Add the Slack action for #security-incidents and a "Webhook" action with the Teams-side URL.
4. Repeat for each Splunk alert rule that needs Teams visibility. Keep a list of which rules post where.

Security Events by Audience

Critical security events (brute force detected, privilege escalation, data exfiltration indicators): Both Slack and Teams. The SOC analyst on Slack and the security manager on Teams both need to see this immediately.

Compliance violations (policy breach, failed access audit): A dedicated Teams channel monitored by the compliance team. These events require documentation and response, not just operational awareness.

System health alerts (index performance, forwarder connectivity): Slack for the engineering team. These are operational rather than security events.

Threat intelligence matches: Both platforms with enriched context — matched indicator, confidence score, affected system — so analysts on either platform can begin investigation without switching tools.

Where SyncRivo Fits (and Where It Doesn't)

What SyncRivo bridges is the human conversation during the investigation. Connect Slack #security-incidents to Teams #soc-alerts, and the analyst's triage notes, the security manager's questions, and the containment decision are visible on both platforms, in both directions, with threads, edits, files, and @mentions kept in sync. The Splunk alert itself still arrives through the Splunk App for Slack and the Teams-side webhook; SyncRivo does not copy it across.

For the Splunk webhook payload mapping reference, see the Splunk Alerts in Slack & Teams integration guide.