search

briandelmsft / STAT-Function

Azure Function for the Microsoft Sentinel Triage AssistanT (STAT)
https://aka.ms/mstat
MIT License
8 stars 1 forks source link

Question: STAT Upgrade #47

Closed mikedizzle closed 8 months ago

mikedizzle commented 8 months ago

Hi there,

Naive question, maybe. I'll preface this with I'm not super familiar with function apps. I'm curious if I can "update" to a new release by simply updating the field in WEBSITE_RUN_FROM_PACKAGE setting in the function app from https://github.com/briandelmsft/STAT-Function/releases/download/v1.5.5/stat.zip to https://github.com/briandelmsft/STAT-Function/releases/download/v1.5.10/stat.zip to get preview 3 release up and running.

The whole redeploy via ARM thing makes me nervous but I'm sure it works if I provide the same values.

Thanks in advance! And I apologize if this question is ridiculous. :)

edit: I added the preview release version I was seeking.

briandelmsft commented 8 months ago

hi @mikedizzle yes, in most cases you can simply update by changing the WEBSITE_RUN_FROM_PACKAGE setting and restarting the function app.

This however does not update the Logic App Connector for STAT (The component of STAT you see in the logic apps interface). In most updates that is not going to be an issue, however if a new module is introduced, or if a configuration option for an existing module is added, those are exposed through that connector and you would not see it until the connector is also update. This is not an issue for 1.5.5 -> 1.5.10 so feel free to just re point.

We are planning additional upgrade documentation for STAT v2 upgrades, and plan to also include an update option that updates the connector only. So for connector changes you would just run that + change the WEBSITE_RUN_FROM_PACKAGE

mikedizzle commented 8 months ago

Awesome! Appreciate the work on this. STAT is phenomenal!