Overview
As of v0.1.2 (and the incoming changes for v0.2.0), the Teams notification template "works", but feels a little repetitive.
As an example, I'm looking over the Teams notifications generated back during a May 22nd demo that I gave and I can see that every pair has a good deal of repetition. I believe that this was by design so that receiving either the initial notification ("Disable user account request received") or the follow-up would quickly tell you what you needed to know right away (top-most details), but contain the same information in the body so that you wouldn't have to go locate the first notification for additional information.
Section breakdown
Main section
- Title
- this is intended to allow the tech to quickly/easily glance at the incoming notification and disregard or read further if the event stands out
- Text
- this is the main text field for the notification; our most important point to convey needs to be here and formatted in a prominent manner
Disable User Request Annotations
- this varies depending on the type of event
- examples
Note: disable request received
Note: Ignoring disable request from "127.0.0.1:44958" for user "abc0001" from IP "10.10.10.10" due to presence in "/usr/local/etc/brick/ips.brick-ignored.txt" file.
Note: Ignoring disable request from "127.0.0.1:44954" for user "abc0009" from IP "9.9.9.9" due to presence in "/usr/local/etc/brick/users.brick-ignored.txt" file.
Note: Disabled user "abc0009" from IP "4.4.4.4"
Note: Received disable request from "127.0.0.1:44948" for user "abc0009" from IP "9.9.9.9"; username is already disabled
Disable User Request Details
- Username
- User IP
- Alert/Search Name
- Alert/Search ID
Alert Request Summary
- Received at
- Endpoint path
- HTTP Method
- Alert Sender IP
Alert Request Headers
- varies
Accept
Content-Type
Content-Length
Expect
User-Agent
message trailer/branding
Example:
Message generated by brick (x.y.z) at 2020-05-22T09:25:19-05:00
Problem/pain points
The item which appears most poorly labeled is the Disable User Request Annotations
section Text
field. The content is good, the leading 'Note:' bit seems out of place.
The main Text
field for the message card is repetitive. For example, notifications 1/2 and 2/2 both have the same line:
Disable request received for user abc0001 at IP 192.168.2.3 by alert TEST - Webhook - Echo
This summary is useful, but it may be worth rethinking how it can be more dynamic based on the event decision/outcome. The second copy of that notification contains that line and just below it in the Disable User Request Annotations
section this line is present:
Note: Disabled user "abc0001" from IP "192.168.2.3"
That seems more useful to have in the main message card Text
field.