Github Security workbook - 'where' operator: Failed to resolve scalar expression named 'commit_oid_s'

Azure / Azure-Sentinel

Cloud-native SIEM for intelligent security analytics for your entire enterprise.

https://azure.microsoft.com/en-us/services/azure-sentinel/

MIT License

4.61k stars 3.02k forks source link

Github Security workbook - 'where' operator: Failed to resolve scalar expression named 'commit_oid_s' #9710

Closed kborowiec-mag closed 10 months ago

kborowiec-mag commented 10 months ago

Describe the bug "Advanced Security Overvivew" tab returns following status:

Other tab like "Dependabot Alerts" returns result correctly

To Reproduce Steps to reproduce the behavior:

Configure Github Webhook Connector
Wait until GHAS data are propagated to githubscanaudit_CL
Go to Sentinel "Github Security" workbook
See error

Expected behavior Workbook generates proper reports

Screenshots

github-actions[bot] commented 10 months ago

Thank you for submitting an Issue to the Azure Sentinel GitHub repo! You should expect an initial response to your Issue from the team within 5 business days. Note that this response may be delayed during holiday periods. For urgent, production-affecting issues please raise a support ticket via the Azure Portal.

kborowiec-mag commented 10 months ago

I have enabled CodeQL Analysis and found that "Code Scanning Alerts" also returns errors:

but "Secret Scanning Alerts" and "Dependabot Alerts" tabs are working fine.

v-sudkharat commented 10 months ago

Hi @kborowiec-mag, Thanks for flagging this issue, we will investigate this issue and get back to you with some updates by 08-01-2024. Thanks!

kborowiec-mag commented 10 months ago

After enabling CodeQL Analysis and running a code scan - "commit_oid_s" appeared in githubscanaudit_CL and problem disappeared.

Looks like having CodeQL enabled is crucial to have "Advanced Security Overview" tab working.

v-sudkharat commented 10 months ago

Hi @kborowiec-mag, thank you for closing this issue. if you still need support for this issue, feel free to re-open it any time. Thank you for your co-operation.