Azure / Azure-Sentinel

Cloud-native SIEM for intelligent security analytics for your entire enterprise.
https://azure.microsoft.com/en-us/services/azure-sentinel/
MIT License
4.53k stars 2.97k forks source link

CCP - Unable to use placeholder inputs in request headers #9456

Closed tonytilbo closed 9 months ago

tonytilbo commented 10 months ago

We are attempting to create a code less connector to our data API, currently we require two headers to be passed with the request one is the API Key but we also require a Client ID header.

We get the users input using the 'UserRequestPlaceholdersInput'

{
    "parameters": {
        "enable": "true",
        "userRequestPlaceHoldersInput": [
            {
                "displayText": "Hostname",
                "requestObjectKey": "apiEndpoint",
                "placeHolderName": "{{hostname}}"
            },
            {
                "displayText": "Client ID",
                "requestObjectKey": "apiEndpoint",
                "placeHolderName": "{{client_id}}"
            }
        ]
    },
    "type": "APIKey"
}

Then attempt to use this placeholder in the 'headers' section of the pollingConfig.request section

"pollingConfig": {
    "auth": {
        "authType": "APIKey",
        "APIKeyName": "ApiKey",
        "IsAPIKeyInPostPayload": false
    },
    "request": {
        "apiEndpoint": "https://{{hostname}/route",
        "httpMethod": "Get",
        "retryCount": 2,
        "queryWindowInMin": 5,
        "timeoutInSeconds": 120,
        "headers": {
            "Accept": "application/json",
            "ClientId": "{{client_id}}"
        }
    }

Describe the solution you'd like I would like the input that the users entered to be set on the request header.

Describe alternatives you've considered We can of course change how the API works to accept only an API Key but would rather we were able to pass users inputted values in headers as a part of the request.

github-actions[bot] commented 10 months ago

Thank you for submitting an Issue to the Azure Sentinel GitHub repo! You should expect an initial response to your Issue from the team within 5 business days. Note that this response may be delayed during holiday periods. For urgent, production-affecting issues please raise a support ticket via the Azure Portal.

v-muuppugund commented 10 months ago

Hi @tonytilbo , Thanks for flagging this issue, we will investigate this issue and get back to you with some updates by 28Nov23. Thanks!

tonytilbo commented 10 months ago

@v-muuppugund is there any update yet?

v-sudkharat commented 10 months ago

Hi @tonytilbo, Could you please share solution name with us or file path in which you are getting issue. Thanks!

tonytilbo commented 10 months ago

This isn't published anywhere yet as we are just testing connecting to our API. The code snippet above should give you everything you need though.

v-sudkharat commented 10 months ago

@tonytilbo, thank you for your response, we will check on this and get by to you by - 11-12-2023. Thanks!

v-muuppugund commented 9 months ago

Hi @tonytilbo ,Apologies for the delayed response ,Could you please follow the documentation (https://learn.microsoft.com/en-us/azure/sentinel/create-codeless-connector?tabs=deploy-via-arm-template%2Cconnect-via-the-azure-portal#request-configuration) Please "type": "OAuth2", "ClientSecret": "{{clientSecret}}", "ClientId": "{{clientId}}", "GrantType": "client_credentials", or OAuth if outh need to generate token,Please use the respective authentication mechanism and request parameters in request i,e. "queryTimeFormat": "yyyy-MM-ddTHH:mm:ssZ", "retryCount": 2, "timeoutInSeconds": 60, "headers": { "Accept": "application/json", "User-Agent": "Scuba" }, "queryParameters" etc,,Please let me know if need more details

v-muuppugund commented 9 months ago

Hi @tonytilbo ,Gentle reminder,,Could you please follow the documentation (https://learn.microsoft.com/en-us/azure/sentinel/create-codeless-connector?tabs=deploy-via-arm-template%2Cconnect-via-the-azure-portal#request-configuration) Please "type": "OAuth2", "ClientSecret": "{{clientSecret}}", "ClientId": "{{clientId}}", "GrantType": "client_credentials", or OAuth if outh need to generate token,Please use the respective authentication mechanism and request parameters in request i,e. "queryTimeFormat": "yyyy-MM-ddTHH:mm:ssZ", "retryCount": 2, "timeoutInSeconds": 60, "headers": { "Accept": "application/json", "User-Agent": "Scuba" }, "queryParameters" etc,,Please let me know if need more details

v-sudkharat commented 9 months ago

Hi, @tonytilbo, since we have not received a response in the last 5 days, we are closing your issue- #9456 as per our standard operating procedures. If you still need support for this issue, feel free to re-open at any time. Thank you for your co-operation.