search

briandelmsft / STAT-Function

Azure Function for the Microsoft Sentinel Triage AssistanT (STAT)
https://aka.ms/mstat
MIT License
8 stars 1 forks source link

AAD Risk module failing when lookup set to false #59

Closed seyed-nouraie closed 2 months ago

seyed-nouraie commented 2 months ago

When lookup parameters in the aadrisk module are set to false, the additional data key is initiated as null. Downstream, the module attempts to run a sum on the null values and gets the error: "TypeError: unsupported operand type(s) for +: 'int' and 'NoneType'\n"

briandelmsft commented 2 months ago

Thanks for reporting this @seyed-nouraie as we discussed in the interim just set the lookups to true to workaround this problem while we explore options to fix it.

Impacted parameters MFAFailureLookup, MFAFraudLookup and SuspiciousActivityReportLookup when false causes the exception.

This is due to the initial current_account settings the output values to None here: https://github.com/briandelmsft/STAT-Function/blob/314012c5a7871fc258c5f1fceff9ac11445ab29e/modules/aadrisks.py#L19-L28

Followed by these blocks not executing due to the parameters disabling them which results in the properties maintaining their initial values of None https://github.com/briandelmsft/STAT-Function/blob/314012c5a7871fc258c5f1fceff9ac11445ab29e/modules/aadrisks.py#L62-L82

Finally when the totals are added up results in the exception due to the NoneType that didn't get replaced due to the lookups not executing: https://github.com/briandelmsft/STAT-Function/blob/314012c5a7871fc258c5f1fceff9ac11445ab29e/modules/aadrisks.py#L88-L91

@piaudonn I think we need to reconsider how we deal with these when the Parameters have those lookups disabled in the bigger picture. An easy fix would be to just make this a 0, but really we should probably make the return null and not include comments indicating that we found 0 when it was configured to not even look.