Who rated this post

Hello, 

I see you are getting 400 Bad request, can you please share which one of the below errors are you getting

invalid_param_value / auto_remediation_only_for_config_remediable_policies / missing_required_param / non_notification_state_selected / invalid_notification_state / invalid_resource_list_id / snooze_time_must_be_relative / dismissal_reason_required / has_overlaps_in_resource_list_rules / missing_required_param

We will need to first add the integration via the API or Prisma Cloud Console and then run the API to add the alert rule with the actual integration name. 

More details on adding integration here >>> https://pan.dev/prisma-cloud/api/cspm/create-integration-v-1/ 

Once the integration has been added, in this case Microsoft_teams, make sure we are using either of below 3 for recipients

For email notifications: List of unique email addresses to notify
For integrations without notification templates: List of integration ids
For integrations with notification templates: List of notification template ids

and for 'type' use microsoft_teams

Your schema shall have similar to what we see below: additional details here >>> https://pan.dev/prisma-cloud/api/cspm/add-alert-rule/ 

{
"alertRuleNotificationConfig": [
{
"dayOfMonth": 0,
"daysOfWeek": [
{
"day": "SU",
"offset": 0
}
],
"detailedReport": true,
"enabled": true,
"frequency": "as_it_happens",
"frequencyFromRRule": "string",
"hourOfDay": 0,
"id": "string",
"includeRemediation": true,
"lastUpdated": 0,
"last_sent_ts": 0,
"recipients": [
"0346b5dd-5b3c-88d8-a1543-ad2c006fe076" 
],
"rruleSchedule": "string",
"templateId": "string",
"timezone": "string",
"type": "microsoft_teams",
"withCompression": true
}
],
"allowAutoRemediate": true,
"delayNotificationMs": 0,
"description": "string",
"enabled": true,
"lastModifiedBy": "string",
"lastModifiedOn": 0,
"name": "string",
"notifyOnDismissed": true,
"notifyOnOpen": true,
"notifyOnResolved": true,
"notifyOnSnoozed": true,
"policies": [
"string"
],
"policyLabels": [
"string"
],
"policyScanConfigId": "string",
"scanAll": true,
"target": {
"accountGroups": [
"string"
],
"alertRulePolicyFilter": {
"availablePolicyFilters": [
"string"
],
"cloud.type": [
"ALL"
],
"policy.complianceStandard": [
"string"
],
"policy.label": [
"string"
],
"policy.severity": [
"string"
]
},
"excludedAccounts": [
"string"
],
"includedResourceLists": {
"computeAccessGroupIds": [
"string"
]
},
"regions": [
"string"
],
"tags": [
{
"key": "string",
"values": [
"string"
]
}
]
}
}

Let us know if there are any additional questions. 

Thanks