briandelmsft / STAT-Function

Azure Function for the Microsoft Sentinel Triage AssistanT (STAT)
https://aka.ms/mstat
MIT License
9 stars 1 forks source link

Fail TI module when all TI checks disabled #68

Closed briandelmsft closed 3 months ago

briandelmsft commented 4 months ago

The TI module currently will pass if all checks are disabled. I don't see any reason why all checks would be turned off on purpose since the module will provide no value, so this will cause an exception to be thrown if it's configured that way

This also updates the test cases to check for the exception and adds a new test case that will return but with no TI found.