search

briandelmsft / SentinelAutomationModules

The Microsoft Sentinel Triage AssistanT (STAT) enables easy to create incident triage automation in Microsoft Sentinel
MIT License
201 stars 55 forks source link

[BUG] MDE - Links to entities are broken #438

Closed piaudonn closed 3 months ago

piaudonn commented 8 months ago

When the MDE module generates a link to anentity, it adds a trailing backslash. It used to work originally, but now, it makes the browsing experience navigating to the main Defender portal instead of the entity.

https://github.com/briandelmsft/SentinelAutomationModules/blob/5c6d24d66885880b4f235353879a07a71d401102/Modules/MDEModule/azuredeploy.json#L148

https://github.com/briandelmsft/SentinelAutomationModules/blob/5c6d24d66885880b4f235353879a07a71d401102/Modules/MDEModule/azuredeploy.json#L920

Fix should be :

... https://security.microsoft.com/user?aad= ...
... https://security.microsoft.com/machine?aad= ...

Thanks to Damon for reporting it.

piaudonn commented 8 months ago

Actually, I don't think the machine needs a fix. Only the users. Needs to confirm.

piaudonn commented 3 months ago

Addressed.