briandelmsft / SentinelAutomationModules

The Microsoft Sentinel Triage AssistanT (STAT) enables easy to create incident triage automation in Microsoft Sentinel
MIT License
212 stars 58 forks source link

[BUG] Calculate-RiskScore - Bad Gateway when missing inputs #343

Closed briandelmsft closed 1 year ago

briandelmsft commented 1 year ago

Describe the bug The LA connector for the Risk Scoring module cannot set specific array properties in ScoringData as required. As a result, it will allow you to save the Logic app even if any values are not set. Currently, all of these values are required so it is easy to potentially miss one during the configuration. Such a misconfiguration currently results in a bad gateway return as no response is sent by the scoring module, making it difficult to troubleshoot and going through unnecessary retries that have no chance to succeed

image

Module Name Calculate-RiskScore

To Reproduce Send null value for any of the module properties

Expected behavior

Assume defaults for: Field Data
ScoreLabel ModuleName of the scored module
ScoreMultiplier 1
ScorePerItem Yes

So for these three inputs there will always be a valid value.

For the module body the switch needs to be made null safe image

Finally, a failure branch should be added to return an unhandled error if we fail to loop for some other reason image