search

Azure / Azure-Sentinel

Cloud-native SIEM for intelligent security analytics for your entire enterprise.
https://azure.microsoft.com/en-us/services/azure-sentinel/
MIT License
4.5k stars 2.96k forks source link

Microsoft Sentinel - JIRA connector not working #10983

Closed pratikghogre8cap closed 1 week ago

pratikghogre8cap commented 3 weeks ago

Describe the bug The Atlassian Jira Audit (using REST API) (Preview) fails to connect.

To Reproduce Steps to reproduce the behavior:

  1. Go to the Atlassian Jira Audit (using REST API) (Preview) connector in Sentinel.
  2. Click on add organization button
  3. Fill the required information.
  4. See error

Expected behavior The connection to establish and the data to start flowing.

Screenshots image

Desktop (please complete the following information):

Additional context The user who created the API is a platform admin, and their credential was used to establish this connection.

v-sudkharat commented 3 weeks ago

Hi @pratikghogre8cap, Thanks for flagging this issue, we will investigate this issue and get back to you with some updates. Thanks!

Latsis commented 3 weeks ago

Looks like Sentinel's Content Hub still has the buggy previous version (3.0.2) up, any information when the fixed 3.0.3 will be published there?

pratikghogre8cap commented 2 weeks ago

Tried the new connector manually, worked. The connector needs to be updated in Content-Hub. @v-sudkharat

v-sudkharat commented 2 weeks ago

Looks like Sentinel's Content Hub still has the buggy previous version (3.0.2) up, any information when the fixed 3.0.3 will be published there?

Hi @Latsis, The new 3.0.3 has been published. Thanks!

v-sudkharat commented 2 weeks ago

Tried the new connector manually, worked. The connector needs to be updated in Content-Hub. @v-sudkharat

Thanks @pratikghogre8cap, for the update. The new 3.0.3 has been published, could you please check and let us know it fixed you issue.

TomicaKaniski commented 2 weeks ago

I'm still getting the 401: Unauthorized, even though I've updated the solution (connector is still v1.0.0). What am I doing wrong?

1 2 3

In "Add organization" I enter "tomica-eviden.atlassian.net" (my organization access URL), my username (email), and API key (generated under Jira's security settings).

Connecting with Postman, with all this info, works well - there are maybe no events in the period checked, but if I check other period, there are, and are returned just fine.

Cheers, Tom

v-sudkharat commented 2 weeks ago

Tried the new connector manually, worked. The connector needs to be updated in Content-Hub. @v-sudkharat

@pratikghogre8cap, could you help us to understand how you configured manually? if possible could you please share screenshots as well.

v-sudkharat commented 2 weeks ago

Hi @TomicaKaniski / @Latsis, We will update the template and will raise PR with correct changes. Meantime, could you please custom deploy the Solution MainTemplate and check whether your issue get resolved. Sharing the MainTemplate and Custom deployment steps- Custom Deployment - CustomDeploymentSteps.docx Main template - Fix.txt

Thanks!

TomicaKaniski commented 2 weeks ago

Thank you, @v-sudkharat! Removed, deployed the fix, but still having the same issue, unfortunately.

v-sudkharat commented 2 weeks ago

Hi @TomicaKaniski, Coud you please check once by using below file :- https://[raw.githubusercontent.com/Azure/Azure-Sentinel/af1e2a30e4d3b8d57c09a1cd7f82825fd6f1c882/Solutions/AtlassianJiraAudit/Package/mainTemplate.json](https://raw.githubusercontent.com/Azure/Azure-Sentinel/af1e2a30e4d3b8d57c09a1cd7f82825fd6f1c882/Solutions/AtlassianJiraAudit/Package/mainTemplate.json)

Maybe the Data connector is not gets overwrite correctly after custom deployment, please check it in different workspace. And if you still get same error, We can connect via a call to resolve this issue. Thanks!

TomicaKaniski commented 2 weeks ago

@v-sudkharat, thank you! This one works!

Connected successfully to both - new workspace and an existing one (which was previously failing): image

Thank you!

Cheers, Tom

v-sudkharat commented 1 week ago

Thanks @TomicaKaniski, for update. This fix will also get updated into upcoming solution version. Thanks! So, closing this issue. If you still need support for this issue, feel free to re-open it any time. Thank you for your co-operation.