Continuous Monitoring — Guide

Get MITRE & framework-tagged security drift alerts in Microsoft Teams.

Continuous Monitoring keeps watch over your Microsoft 365 security posture and alerts you in Microsoft Teams the moment something drifts — a passing control starts failing, a policy weakens, or a new gap appears. Every alert is tagged with the MITRE ATT&CK technique and the compliance frameworks it affects. This is a separate product from the one-time assessment report.

What Continuous Monitoring does

• Detects configuration drift. Kyvoi re-checks your tenant on your chosen schedule and compares it to the last known state.
• Alerts only on change. No change means no message — no noise.
• Tags every alert with context — control, severity, MITRE ATT&CK technique, and compliance clauses impacted.
• Delivers into Microsoft Teams as rich, actionable cards with deep links to fix the issue in the Microsoft portal.

Monitoring complements — not replaces — Microsoft Defender. Defender detects active threats; Kyvoi detects posture drift and compliance regressions in your configuration.

How alerts are delivered

Alerts go to a Microsoft Teams channel using an incoming webhook you create and control. Kyvoi never connects into your network — it sends an outbound message to the webhook URL you provide. No inbound connections, no agents, and no firewall changes.

Noise control (three tiers)

• Instant alerts — Critical and High regressions are pushed immediately.
• Digest — Lower-severity changes are batched into a periodic summary.
• Silence — Nothing changed since the last check means nothing is sent.

Setting up your Teams webhook URL

1. In Microsoft Teams, open (or create) the channel where you want alerts — for example, Kyvoi Alerts.
2. Next to the channel name, click the ⋯ (More options) menu.
3. Choose Workflows.
4. Select "Post to a channel when a webhook request is received" (in some tenants: "Send webhook alerts to a channel").
5. Confirm the Team and Channel, then create the workflow.
6. Copy the webhook URL it generates — this is what you paste into Kyvoi.

Configuring monitoring in Kyvoi

On the monitoring settings page you provide three things:

• Microsoft Teams webhook URL — the URL you copied above.
• Instant-alert severities — which severities alert immediately (default: Critical and High). The rest are batched into a digest.
• Check frequency — every 15 minutes, 30 minutes, hour, 2 hours, or 24 hours.

More frequent checks mean faster detection. Billing is metered by check volume. Click Save, and a confirmation tells you the cadence and channel.

What each alert contains

• Control — the specific control that changed.
• Change — the status transition (e.g. PASS → FAIL).
• Severity — Critical, High, Medium, or Low.
• MITRE ATT&CK — the related technique (e.g. T1110 — Credential Access).
• Compliance impact — the framework clauses affected.
• Actions — deep links to fix in the Microsoft portal and view the MITRE technique.

Security and privacy