Google Chat Spaces notification webhook

Issue

Your SOC wants to receive notifications in a Google Chat Space when a new Red Canary threat is published. However, Google Chat is not a built-in option in Red Canary's Automate Playbook actions.

Environment

Google Workspace

Resolution

Create a new Automate Playbook (optional)

1. In your Red Canary portal, using the left sidebar, navigate to Automation > Playbooks.
2. Click the "Create New Playbook" button
3. Give your playbook a meaningful name, like "Google Chat Threat Notification".

Configure the "Invoke Webhook or API" action

1. Open your Google Chat Space, expand the Space menu, and select "Apps & integrations".
   Note: A Space Manager may need to perform this step.
   
2. Click "Add webhooks", enter "Red Canary" as the name, and click Save.
3. Click the three dots next to the Red Canary webhook and select "Copy link".
   
4. In your Red Canary portal, open the Playbook that you created.
5. Click "Add Action", and select "Invoke Webhook or API" from the list of supported actions, and click "Add to Playbook".
   
6. Paste the webhook link into the URL field.
   
7. Paste the following into the HTTP Headers section:

   Content-Type=application/json

8. Select "Custom Payload" from the Payload dropdown.
9. Paste the following into the Payload field and customize it to fit your use case:
   

   {
   'text': '$Detection.headline \n\n Severity: $Detection.severity \n Endpoint: $Endpoint.hostname \n Domain: $EndpointUser.domain \n User: $EndpointUser.username_without_domain \n Published: $Detection.published_at \n \n Details: $Detection.details \n \n Link: $Detection.url \n--'
   }

10. Click Save.
11. To test your Playbook, select "Run" under the left Actions menu, and select a Threat. The notification should appear in your Google Chat Space.