search

Azure / Azure-Sentinel

Cloud-native SIEM for intelligent security analytics for your entire enterprise.
https://azure.microsoft.com/en-us/services/azure-sentinel/
MIT License
4.53k stars 2.97k forks source link

Deploy ASIM to Azure Fails #9546

Closed Wallace4444 closed 10 months ago

Wallace4444 commented 10 months ago

Describe the bug When deploying ASIM to Azure from https://github.com/Azure/Azure-Sentinel/tree/master/ASIM, the deployment fails.

A number of parsers fail with:

The resource write operation failed to complete successfully, because it reached terminal provisioning state 'Failed'. (Code: ResourceDeploymentFailure)

At least one resource deployment operation failed. Please list deployment operations for details. Please see https://aka.ms/arm-deployment-operations for usage details. (Code: DeploymentFailed), {

"error": {

"code": "NewerDataExists",

"message": "Failed to modify resource '/subscriptions/<subid>/resourceGroups/<resourcegroup>providers/Microsoft.OperationalInsights/workspaces/<workspace>', newer data exists. If you are using eTag please use the latest one and try again in a few minutes. Operation Id: '64498f4aba872aea66c58ac8b611b83c'"

}

} (Code: Conflict)

Have tested on a brand new Sentinel workspace and it fails with same error.

To Reproduce Steps to reproduce the behavior:

  1. Go to '(https://github.com/Azure/Azure-Sentinel/tree/master/ASIM)'
  2. Click on 'Deploy to Azure'
  3. Fill in details and deploy
  4. See error

Expected behavior ASIM Parsers deployed successfully.

Screenshots image

Desktop (please complete the following information):

github-actions[bot] commented 10 months ago

Thank you for submitting an Issue to the Azure Sentinel GitHub repo! You should expect an initial response to your Issue from the team within 5 business days. Note that this response may be delayed during holiday periods. For urgent, production-affecting issues please raise a support ticket via the Azure Portal.

vakohl commented 10 months ago

hi @Wallace4444 we are aware of this issue and we're looking into its fix. For now, can you please try installing the schema you need individually. If you get error with individual schemas as well, please retry 2-3 times. This issue is more related to Log Analytics than Sentinel, we are working with concerned teams to get this resolved soon. Thankyou

v-sudkharat commented 10 months ago

Hi @Wallace4444, hope you are doing well. As this issue has already been reported in the following GitHub issue: - https://github.com/Azure/Azure-Sentinel/issues/8623 and is presently under investigation, we recommend monitoring the issue for updates. Consequently, we are closing this issue for the time being. Feel free to comment on #8623 if there is anything you would like to share more. Thank you for your co-operation.