CIPP

Before you start

• The admin role in ZenTop Triage. Everyone can see the Integrations tab, but only admins can load and change alert source settings.
• Access to CIPP’s Settings > Notifications and Tenant Administration > Alert Configuration.
• A board, team, or queue for these tickets, set up in Routing and service scopes with a primary New status.
• Optionally, your CIPP address, so guidance notes can link to the right CIPP pages. CIPP doesn’t include its own address in alerts.

Connect CIPP

1. Open Setup → Configuration → Integrations, then select CIPP under Microsoft 365.
2. In Webhook, select Generate webhook key. Copy the API key header value straight away: ZenTop Triage stores only a hash of it, so it can’t be shown again. Use the Copy buttons to copy the Webhook URL and the API key header name as well.
3. In CIPP, follow the steps shown on the page:
   1. Open Settings > Notifications.
   2. Paste the webhook URL. Set webhook authentication to API Key Header, with the header name and key you copied.
   3. Turn on Use Standardized Alert Schema and save.
   4. Use Send Test Alert with the webhook selected. Last Test Alert under Intake Status shows when it arrives. A test alert never opens a ticket.
   5. In Tenant Administration > Alert Configuration, choose Webhook for scripted alerts and Generate a webhook for audit log alerts.
4. In Intake Settings, choose the board (team or queue, depending on your PSA) where CIPP tickets open. Optionally enter the CIPP URL and choose a Catch-all company, then select Save Settings.
5. Turn on Alert intake. The switch is available once a webhook key exists and an intake board is saved.
6. Review CIPP Tenant Mappings. Tenants appear after their first alert. To map a tenant before that, use Map a tenant before its first alert: enter its Tenant default domain, for example contoso.onmicrosoft.com, choose the PSA company, and select Add mapping.

What happens to an alert

• Accepted, then ticketed. ZenTop Triage accepts each alert and turns stored alerts into tickets in a background run every minute, opening at most 10 new tickets per run.
• What is ticketed. Scripted alerts, audit log alerts, drift, baseline, and custom test alerts open tickets. Test alerts, logbook digests, standards notifications, scheduled-task notices, baseline “remediated” events, and alerts with no findings do not.
• One ticket per problem. Alerts are grouped by tenant, alert type, and subject (the user, for audit log alerts). While the group’s ticket is open, new findings are added to it as a note instead of opening another ticket, and findings already on the ticket are not added again. If that ticket was merged or bundled, the note goes to its open parent.
• Company. The ticket opens for the tenant’s PSA company: a manual mapping first, then a match of the tenant’s domain to a PSA company name or identifier, then the catch-all company. Without any of these, the alert waits up to 24 hours for a mapping and is then skipped.
• Triage. The ticket opens on the intake board in its primary New status and then goes through normal triage: routing, classification, priority, related tickets, attachments, knowledge lookup, and dispatch, subject to your validation mode settings.
• Ticket content. The title starts with “CIPP:” and names the alert and its subject. The description lists the tenant, the alert details, what CIPP found, and the actions CIPP already took. An internal guidance note explains why the alert matters and suggests next steps, with links to CIPP when the CIPP URL is set.
• Closing. ZenTop Triage doesn’t close CIPP tickets, because CIPP doesn’t report when an alert is resolved. Once the ticket is closed, the next alert in its group opens a new ticket.

CIPP alert intake works with ConnectWise, HaloPSA, and Autotask.

Turn it off

• Turn off Alert intake. While it is off, ZenTop Triage acknowledges CIPP’s alerts and discards them, so nothing is replayed when you turn it back on. Test alerts still show. Existing tickets are not changed, and the Integrations list shows Intake off.
• To replace the key, select Regenerate key, then Replace key. The old key stops working immediately, and CIPP stops delivering until you enter the new key in CIPP.
• To stop CIPP from sending at all, remove the webhook in CIPP.

Troubleshooting

Message or symptom	What to check
Last Alert Received stays empty	Requests with a wrong or missing key are rejected and not recorded. Check the header name and key in CIPP, or generate a new key.
“CIPP sent a body ZenTop Triage could not read”	Turn on Use Standardized Alert Schema in CIPP.
“New tickets are on hold”	Choose an intake board in the CIPP settings. The board needs a primary New status in Boards & Routing.
“Alerts are waiting for the PSA”	ZenTop Triage couldn’t reach your PSA. Alerts wait and continue automatically; an alert held for more than 72 hours fails.
Recent alert shows “Waiting for a tenant mapping”	Map the tenant, or choose a catch-all company.
Recent alert shows “Skipped: no company”	No mapping or catch-all was found within 24 hours.
Guidance notes have no links to CIPP	Enter the CIPP URL in Intake Settings. It must be an https address.