Files

master c58a236d70 Doctor plugin checks: implement health check classes and documentation

Implement remediation-aware health checks across all Doctor plugin modules
(Agent, Attestor, Auth, BinaryAnalysis, Compliance, Crypto, Environment,
EvidenceLocker, Notify, Observability, Operations, Policy, Postgres, Release,
Scanner, Storage, Vex) and their backing library counterparts (AI, Attestation,
Authority, Core, Cryptography, Database, Docker, Integration, Notify,
Observability, Security, ServiceGraph, Sources, Verification).

Each check now emits structured remediation metadata (severity, category,
runbook links, and fix suggestions) consumed by the Doctor dashboard
remediation panel.

Also adds:
- docs/doctor/articles/ knowledge base for check explanations
- Advisory AI search seed and allowlist updates for doctor content
- Sprint plan for doctor checks documentation

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

2026-03-27 12:28:00 +02:00

1.9 KiB

Raw Blame History

checkId, plugin, severity, tags

checkId

plugin

severity

Teams Connectivity

What It Checks

Verifies that the configured Microsoft Teams webhook endpoint is reachable. The check:

Sends a minimal Adaptive Card payload to the webhook URL with a 10-second timeout.
Passes if the response is successful (HTTP 2xx).
Warns if an unexpected HTTP status is returned (invalid, expired, or revoked webhook).
Fails on connection timeout or HTTP request exceptions.

The check only runs when Notify:Channels:Teams:WebhookUrl is set and is a valid absolute URL.

Why It Matters

An unreachable Teams webhook means notifications silently fail to deliver. Operations teams will miss release alerts and security findings if the webhook is broken.

Common Causes

Invalid or expired webhook URL
Teams connector disabled or deleted
Microsoft 365 tenant configuration changed
Firewall blocking outbound HTTPS to webhook.office.com
Proxy configuration required

How to Fix

Docker Compose

docker exec <notify-container> curl -v https://webhook.office.com/

Bare Metal / systemd

curl -v https://webhook.office.com/
curl -H 'Content-Type: application/json' \
  -d '{"text":"Doctor test"}' \
  'https://YOUR_TENANT.webhook.office.com/webhookb2/...'

Check Microsoft 365 service status at https://status.office.com.

Kubernetes / Helm

kubectl exec -it <notify-pod> -- curl -v https://webhook.office.com/

If the webhook is broken, recreate it: Teams channel > Connectors > Incoming Webhook > delete and recreate.

Verification

stella doctor run --check check.notify.teams.connectivity

check.notify.teams.configured — verifies Teams webhook URL is set and valid
check.notify.queue.health — verifies the notification delivery queue is healthy

1.9 KiB Raw Blame History