search

briandelmsft / STAT-Function

Azure Function for the Microsoft Sentinel Triage AssistanT (STAT)
https://aka.ms/mstat
MIT License
9 stars 1 forks source link

BUG - Playbook Module failure #31

Closed piaudonn closed 1 year ago

piaudonn commented 1 year ago

This is to refer and address https://github.com/briandelmsft/SentinelAutomationModules/issues/427

It seems that we might need to adjust the API version for the REST call for playbooks calls. Need to check if that impact other types of calls potentially using the ARM endpoint.

briandelmsft commented 1 year ago

@piaudonn Have you been able to reproduce this? I can only reproduce it when the STAT identity doesn't have access to execute the playbook. The 2022-07-01-preview API works fine for me. I note the permissions issue because it doesn't throw a 401/403, it throws a 400 / Bad request

piaudonn commented 1 year ago

I just tried. Works with both api-versions. Shan't we update the version anyways?

piaudonn commented 1 year ago

Oh I just saw #32

briandelmsft commented 1 year ago

@piaudonn As long as the input is structured the same we can update to the new version, the doc isn't clear but I think based on your testing it likely is.

We should probably also add some error handling for the 400 to include some text to verify permissions to the logic app as the error isn't very intuitive at all. Not even a 401/403 like you may expect for a permissions error