Azure / Azure-Sentinel

Cloud-native SIEM for intelligent security analytics for your entire enterprise.
https://azure.microsoft.com/en-us/services/azure-sentinel/
MIT License
4.38k stars 2.89k forks source link

Pull request validation error for KQL to YAML conversation #10667

Open mattnovitsch opened 2 weeks ago

mattnovitsch commented 2 weeks ago

When trying to commit a pull request for a KQL that I converted to YAML, I get the following error message:

Check failure on line 24 in Build log

@azure-pipelines azure-pipelines / Azure.Azure-Sentinel (YamlFileValidation) Build log #L24 An error occurred, please open an issue Check failure on line 26 in Build log

@azure-pipelines azure-pipelines / Azure.Azure-Sentinel (YamlFileValidation) Build log #L26 Bash exited with code '255'.

And

Check failure on line 73 in Build log

@azure-pipelines azure-pipelines / Azure.Azure-Sentinel (KqlValidations) Build log #L73 Error: The process '/opt/hostedtoolcache/dotnet/dotnet' failed with exit code 1 Check failure on line 78 in Build log

@azure-pipelines azure-pipelines / Azure.Azure-Sentinel (KqlValidations) Build log #L78 Dotnet command failed with non-zero exit code on the following projects : [ '/home/vsts/work/1/s/.script/tests/KqlvalidationsTests/Kqlvalidations.Tests.csproj' ]

v-sudkharat commented 2 weeks ago

Hi @mattnovitsch, Thanks for flagging this issue, we will investigate this issue and get back to you with some updates by 26-06-2024. Thanks!

v-sudkharat commented 2 weeks ago

Hi @mattnovitsch, We have investigated the validation failures, and found that the failure occurred due to indentation error, which we fixed into rule and raised Draft PR - https://github.com/Azure/Azure-Sentinel/pull/10671 for reference. Please refer above draft PR and make changes accordingly. And while committing the updated changes please make sure branch should be updated with Master. Thanks!

mattnovitsch commented 2 weeks ago

I refreshed my fork but I still get the same message.

v-sudkharat commented 2 weeks ago

@mattnovitsch, I can see the new files has been into the PR, our review team will check on validations and will help you to fix on it.