search

Azure / Microsoft-Defender-for-Cloud

Welcome to the Microsoft Defender for Cloud community repository
https://azure.microsoft.com/en-us/services/security-center/
MIT License
1.71k stars 766 forks source link

Subscription Not Found (HTTP - Get Azure VM) #852

Open lok1946 opened 8 months ago

lok1946 commented 8 months ago

Bug Having set up the logic app according to instructions and assigned appropriate permission roles, when a security alert from Microsoft Defender for Cloud triggers the logic app all steps are completed successfully but consistently fail at HTTP - Get Azure VM).

To Reproduce You would need to monitor the process in our Azure Government environment.

Expected behavior The expected behavior is for the logic app to complete its flow. As a part of the flow to add an IP address to the denied list in the NSG and to email me at the specified email address.

Additional context Add any other context about the problem here.

bbhorrigan commented 6 months ago

Did you ever figure this out? I was down the path of figuring out if it had something to do with the .US domain, I had a similar issue I was trying to sort thru.

lok1946 commented 5 months ago

No. Haven't found a resolution for this. I can change the HTTP_Get_VM to a non-managed request (no http) and it works as it should getting all the specifications of the VM. However other HTTP sections of the app are more difficult to resolve. If I can get rid of all the HTTP and still have the results I'm looking for, then I'll be happy with this app. BTW: I got this app from a verifiable source on GitHub. Here is the URL if you'd like to take a look at it: https://github.com/Azure/Microsoft-Defender-for-Cloud/tree/main/Workflow%20automation/BlockBruteforceAttack