Azure / SimuLand

Understand adversary tradecraft and improve detection strategies
MIT License
700 stars 80 forks source link

Enabling Data Connectors #10

Closed hacknorris closed 3 years ago

hacknorris commented 3 years ago

Hello - on part two - deployment steps - I'm getting a conflict error on enabling data connectors. Any insights or how to fix this would be greatly appreciated. My connector for Office ATP and Microsoft Threat Protection states not support api version. This is in my commercial test tenant.

Conflict

{ "status": "Failed", "error": { "code": "DeploymentFailed", "message": "At least one resource deployment operation failed. Please list deployment operations for details. Please see https://aka.ms/DeployOperations for usage details.", "details": [ { "code": "BadRequest", "message": "{\r\n \"error\": {\r\n \"code\": \"BadRequest\",\r\n \"message\": \"Connector kind 'MicrosoftThreatProtection' is not supported in api-version: '2020-01-01'\"\r\n }\r\n}" }, { "code": "BadRequest", "message": "{\r\n \"error\": {\r\n \"code\": \"BadRequest\",\r\n \"message\": \"Connector kind 'OfficeATP' is not supported in api-version: '2020-01-01'\"\r\n }\r\n}" }, { "code": "Unauthorized", "message": "{\r\n \"error\": {\r\n \"code\": \"InvalidLicense\",\r\n \"message\": \"Missing consent\"\r\n }\r\n}" } ] } }

Cyb3rWard0g commented 3 years ago

Hello @hacknorris ! thank you for the heads-up. I have to do a quick test on that tomorrow morning and get back to you. I wonder if the API names changes recently? I have talked to a few folks in the community and the deployment seemed to work just fine. However, something might have changed. I was reading the API docs, and I can see that those names do not exist there.

https://docs.microsoft.com/en-us/rest/api/securityinsights/data-connectors/list

Cyb3rWard0g commented 3 years ago

I just tested it and got the same error message. I just updated Azure-Sentinel2Go project which provides the templates to set up the data connectors: https://github.com/OTRF/Azure-Sentinel2Go/commit/8f7af5254c1ab581f47155fd808e562de1e2065e

Testing it again now.

Cyb3rWard0g commented 3 years ago

Yayy! The update worked ;)

image

Let me know if it works on your end too please to close this issue.

hacknorris commented 3 years ago

Thank-you Roberto for the quick fix and reply!! am out office for a couple of days! will test when i get back this weekend.

Dan

On Jun 23, 2021, at 22:42, Roberto Rodriguez @.***> wrote:

 Yayy! The update worked ;)

Let me know if it works on your end too please to close this issue.

— You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub, or unsubscribe.

Cyb3rWard0g commented 3 years ago

OK no worries @hacknorris ! Thank you for letting me know. I ran through the whole deployment and everything deployed properly :)

image

Enjoy your time off! Thank you for letting me know and for testing the project. I hope you can get through the whole lab and also let me know what you think about it :) Any feedback is greatly appreciated!

hacknorris commented 3 years ago

@Cyb3rWard0g -- thankyou -- also confirming the API specific issue has been resolved. I have a couple of other errors flagging inconsistently tied to the data connectors (missing consent / invalid license). Shall I close this issue out? or would you prefer to tag onto here? Not sure exactly why I do have valid licensing (I'm using my E5 Dev licensing) -- but have deleted and redeployed -- issue comes and goes away.

cybersecgreg commented 3 years ago

@hacknorris did you ever find the root cause on those missing consent/invalid license errors?