How CIPP routes alerts to email, webhooks and HaloPSA tickets

Hey guys, it's time to do, oh hang on, one sec. Hello. Right. Okay. Well, I haven't seen that. There's, I haven't seen any tickets or anything. I don't know how we meant to have known. Okay. Yeah, fine. All right. Okay. I'll speak to you later. Cheers. Bye. Okay. Well, I guess we're going to have to start configuring some alerts.

Cool. So we finally got CIPP. We've got the boss to pay for it. It's all configured. It's working. Now we need to set up some notifications, some alerts, make sure that we can actually find out about the problems that are going on within our tenants, users, all those different things. Let me show you how. So the first thing we need to do is actually configure the notifications. So if we go on the left sidebar to CIPP application settings and then we've got a few tabs and at the top we're going to click on notifications. So this is the backend settings for everything that you would do in CIPP and the actual notification settings specifically. You'll need to be an admin to view this page. Base users won't be able to make changes here for good reason.

So once this finishes loading, I guess already we can see the different options we have. So email address, comma separated. So for example, if I wanted to get emails from CIPP specifically to my support address, I could put support@renada.co.uk. And then I could chuck in a comma and say I'm going to put my own email address as well. And potentially maybe we have an alerts mailbox, so we'll do alerts@renada.co.uk as well. And all three of those when configured in different things, which we'll get to, will receive an email of the specific alert or log or whatever entry we've sort of listed this to.

Next off is the web hook URL. There's a few ways you can make use of this, but namely in my example, and it'll be a thing that I'll show off eventually, is through Halo, we can use custom integration runbooks, and we can put the web hook URL in there and have the alerts go directly to the web hook source, and then based off that, we can use some API commands and obtain a bit more data for the specific thing we want to do and potentially even trigger different remediations outside of CIPP itself. So this is an additional feature and obviously it's specific to one web hook. There's no comma separation here. We're sending it to one place and then obviously that function. So potentially even an n8n or Roost something like that can work with the data that's provided by CIPP to then do some additional things.

Maybe even format it differently the way that it comes into Halo rather than it being an email formatted thing or through an integration which you'll see is down here. The integration one, if I switch that on, will effectively all the notifications and things will go directly to the PSA and the PSA configuration here we'll just jump back and forth. Maybe I'll duplicate this tab and we go to integrations here. HaloPSA is obviously my example here. We've got this configured to our sandbox and the integration is enabled. So once you have tenants mapped as well, you can then set it to effectively log a ticket directly to HaloPSA as that use case CIPP and the tenants.

And then these other two drop downs we have here, we have the ability to choose different logs we want to receive alerts from. So this is all of the different things that you can do in CIPP. And then obviously you may want to get an alert when a user in CIPP executes the offboarding wizard because we want to keep track of the offboards that are completed, just as an example. And then the severity of the alerts we want to be notified. So base built-in, I guess you call it, functionality is we're just getting alert alerts. But we could also increase the severity to critical, warning, error. I mean, potentially all of these could be of use to you. You can configure it, test it, run it, and see how it's working for you and obviously come back in and change that later.

There's also this switch here to receive one email per tenant. So by default when it sends to the email or the web hook on the schedule, it's going to give us the logs that we have selected as well as it all being formatted in one email. So not as well as, it will be formatted in one sort of email thread with different tenant IDs for you to view. If you instead set it to one email per tenant, that will then send obviously one email per tenant with specific tenant ID for that user. So it might be a good use case for, you know, logging it directly to a specific tenant so that you can then with your PSA as an example, assign that to that customer, work with it with an end user in a bit more of a formatted way, I guess, rather than trying to split things out of one email.

So if I hit send test alert, I'll do that. I'm going to do the email. I'm not going to do the web hook and I'll do the PSA so we can see the examples. Cool. So if I switch in, it looks like it's done. Ticket ID 157. I'll go to my Halo. Cool. And we can see that in our service desk under our alerts view, we've got a CIPP notification test here, test from notification settings with nothing else in it obviously because it's a test. If I check my emails as well, I can see I've got an email to support, Jacob, and alerts with the same content. So that is good.

And if I was to do the web hook URL, why don't we just do that quickly? If I go into configuration here, I'll go to custom objects, custom integrations, get a sneak peek of some of the runbooks we have on the go. And I'll do CIPP notifications test. And I'm going to have to fix that because I will go crazy otherwise. And we will set this to be started from Halo and from public endpoint. We're not going to add any authentication because there's no current configuration for that in CIPP. If I'll save that, I'll copy this URL and then I will switch back here, add that as the URL, submit it. And then I will send a test alert to the web hook.

And if I switch back here again and go to my log, I should see that come through in a minute. But I've set this to be enabled for production only, which is wrong. So hang on, let me change that back. And I'm probably gonna have to resend this quickly. So if I send test alert again, web hook, confirm that, make sure that's finished, go to our Halo tab, hit refresh here. Cool. So I can see this one here. If I open that and go to request data, I can see the request that was sent and the payload from CIPP. So the title being CIPP notification test and the text being test from notification settings. So similar to the actual payload ticket, if we go back to the service desk again and alerts, CIPP notification test, effectively you've got the title which was the same as the payload and then the text being the actual summary of the ticket when it's created.

So obviously this web hook means that if your PSA is not one of the included integrations, you can still work with it. If you have some form of API or web hook thing in your PSA, you can work with it in that way. Otherwise, it's going to be like an n8n or a Roost kind of platform automation in that way. Cool. So notification settings are set up. Now we can do some alerting. So on the notification settings, if I was to hit my bookmark and go to the scheduler, which is under tools, you can see a bunch of the schedules and I can add a job. So after I've configured a job and done all that thing, something we'll touch on in the future if we haven't done it already is post execution actions, of which we have our notification options. So web hook, email, PSA are available in this dropdown. They will be there by default but obviously we know we've configured them all. So I can add each of them in here to do the notification for me directly to those configured sources as part of the scheduled task or job that I've made. It will then give me information on that to those sources.

So these post execution actions and notifications and things like that appear in many different places in the UI. So the most important thing to do is obviously make sure we've done the configuration here in our notification settings and obviously updating them if there's issues going forward. Cool. So now that we've done that, we know that's all working. I'll go to tenant administration, administration, and then alert configuration. So in here I can add that to my bookmarks as well. We can add alerts for specific things. So there's one there already. You can see if I go add alert, we get the add alert UI. So effectively two different types of alerts we can make here. So audit log alerts based on Microsoft audit log and scripted CIPP alerts which are alerts based on CIPP's data.

Namely the different scripts that are configured by the CIPP guys to do and return and achieve different goals. So the way this works, we'll start with the CIPP one cuz it's just the one I happen to click on. Same as everywhere else you would expect, the tenant selector is the list of options. So groups, something I mentioned in the top 10 features video, can be created as sort of segments of different groups. So the YouTube tenants group can contain a couple of different tenants here, so that I can select the group rather than having to manually go in and select this one and that one as an example there. If I select all tenants, that's going to include everyone. And then I can exclude specific tenants from that example. So maybe I want to do all except the partner tenant.

With that then we can do alerting script PowerShell configuration, whatever we want to choose based on what's preconfigured. There's something that isn't here, go ahead and try to dev into CIPP as a feature request. Or I guess not a feature request, a feature completion, we'll call it. You can choose a bunch of different things. And let me find one that would be good for our example. Maybe something that I can trigger reasonably easy. Global admin accounts without alternate email address. I wonder if our partner tenant has that. Let's try that. When should it run? If I set now, it's going to pipe in the current date. The time is 11 minutes ago, that is. So it's effectively just piping it to do it before, which means it'll be in the schedule, which means it'll run immediately. And every 7 days recommended for this. Let's leave it as that. And I'm going to have it go directly to the PSA. I might make it go to the email. And I may as well just make it go to the web hook as well. That way we can see all the different examples. And I'll get regular emails about it because maybe I don't check the PSA or the web hook very often. So save that alert and we'll see that this is an added task here. And if I go back to alerts, we'll see it in the list. So Renada's specific tenant, partner tenant alert on global admin. Cool.

If we go back here then add another alert and we go to the audit log. You can see the differences between the two. So you can already see here different conditions, log source, alert presets, things like that. So again, I'll do all tenants here, and this time I'll exclude the partner tenant, and we'll do an alert preset. So I'm sure we've all had different problems with users getting breached, calling up the help desk and saying that, you know, they can't access their emails or there's no emails coming in or some weird issue like that. And it turns out to be that they clicked the phishing link and it's a whole thing. But one of the fixes you need to do is remove inbox rules.

Because typically for whatever reason these hackers would auto forward emails to the RSS feeds folder. This is a good thing to preemptively, I guess not preemptively, but after the fact know that there's someone doing something malicious because typically this isn't a thing that most users would do. So it's a good thing to try and look at and that's going to auto select the Exchange log source for us because it knows that it's using that based on these preconfigured rules here. So if I didn't want to choose that, I obviously could have gone through and selected my own log source, different conditions and things like that to customise my own like it says here. But I can still also add different conditions here if there's certain things that I wanted to be sure of. Potentially it's only a specific user I want to apply it to or something like that.

But nonetheless, because I've selected a preset, it's auto populated the different properties that it should do to effectively be that preset. And then I can also choose different actions to take. So I can generate an email, generate PSA ticket, generate a web hook because they are the different notification settings we configured earlier. As well as different options here specifically for alerts, disable the user in the log entry, execute a BEC remediation. So that is business email compromise and that basically what it means is a cleanup of the user because of effectively a confirmed hack. Right? So we have a full documentation page on the CIPP docs for this, forward slash administration users user BEC, which is the compromise remediation. I'll put the link in the description of the video but all the documentation on this is listed here, what it's doing, running an analysis, all those different things, and the actual actions that it's doing.

So the option that we would be selecting there would be remediate user, which is blocking the sign in, resetting the user's password, disconnecting all the current sessions, removing all MFA methods, and disabling all inbox rules. So big thing you can do if you choose to, but you don't have to. So maybe this case I'll leave it out and I'll save the alert there. So now jumping back to the main alerts page we can see we've got three alerts. We've got the all tenants with the exclusion for the RSS rule. We've got the partner tenant specific, global admin accounts without alternate email address, and the one that was already there before. So this is obviously as soon as it's seen in the Microsoft audit log, it's going to create this one here. This one is going to run every seven days because it is a script per se. So it's being run by the CIPP engine. This one is when it's seen effectively.

So that is pretty much notifications and alerts. It's slowly sort of changing over time. So this alert page is slightly different to what it was at one point. There are different places in the portal that you can configure these different alerts for. I'm not sure there's much more on the topic at the minute, but it is obviously very important to get this set up and working when you're using CIPP. Otherwise everything you're doing is kind of in the UI and you're not making use of data or alerts or anything like that as you would expect with any other application you configure. So hopefully this has been helpful. If you got any questions, chuck them in the comments. Anything majorly urgent, maybe shoot me an email, whatever works for you. And I will speak to you in the next video.