briandelmsft / SentinelAutomationModules

The Microsoft Sentinel Triage AssistanT (STAT) enables easy to create incident triage automation in Microsoft Sentinel
MIT License
201 stars 55 forks source link

[QUESTION] Incident comments - max lines #447

Closed SimonRefslund closed 1 month ago

SimonRefslund commented 1 month ago

Hi guys.

Sometimes the STAT app needs to add long comments to the incident, however, I've noticed that when the comments have a large number of lines, they seem to exceed the currently allowed limit. As seen in the picture below.

I've searched for a setting to increase the maximum number of lines allowed per comment, but I haven't been able to find any.

image

briandelmsft commented 1 month ago

Hi @SimonRefslund

Sentinel has a limit of 30,000 characters per comment. If you exceed that number the comment will fail to create.

So, we've done 2 things:

  1. Limited the output to never exceed 30,000 so in the unlikely event we hit that number a comment will still be made though it will likely be hard to read as it will almost certainly break the html format: https://github.com/briandelmsft/STAT-Function/blob/70e6903252229bac0ff912f3f6d1d0d56bd567d5/shared/rest.py#L213

  2. Chosen a max number of rows per module that we believe will safely fall within that limit which is 20 by default if not explicitly defined otherwise by the module when converting the array to html https://github.com/briandelmsft/STAT-Function/blob/70e6903252229bac0ff912f3f6d1d0d56bd567d5/shared/data.py#L4

There is no exposed setting via the connector to manipulate this, but if you're modifying the python package you could include max_rows=x in the call to the add_incident_comment() function to add more rows, but be aware if you exceed 30,000 it will be truncated and the table will likely not render.

Another thing to note is the modules DetailedResults array in it's output will contain all rows, even when truncated in the table, so you could also do something with that.

About the only thing we can do to reliably increase row count would be to build in some logic to the table generation to generate the table with all rows, measure the size and then determine if any need to be truncated.

SimonRefslund commented 1 month ago

I see. Thank you for the clarification