Random 500 errors when posting to https://sentinelus.azure-api.net/{workspaceId}/threatintelligence:upload-indicators?api-version=2022-07-01

cudeso / misp2sentinel

MISP to Sentinel integration

MIT License

60 stars 20 forks source link

Random 500 errors when posting to https://sentinelus.azure-api.net/{workspaceId}/threatintelligence:upload-indicators?api-version=2022-07-01 #84

Closed jusso-dev closed 8 months ago

jusso-dev commented 8 months ago

Hey all,

Wondering if anyone knows why I'm getting random empty 500 responses when posting to the above API in the solution? I've inspected the response body and manually crafted an API message but I am unable to determine why I'm getting this response?

@cudeso any ideas?

cudeso commented 8 months ago

Hello,

I've seen this on three occasions:

If there is a proxy between you and Sentinel which "mangles" the requests
Temporary hiccups with Sentinel (this happens)
The Azure App no longer has sufficient permissions or an outdated secret

jusso-dev commented 8 months ago

Thanks for that! #1 is not a possibility in my case, but will check the secret again and perms, either way I think we can confirm this is a poor user experience on MS behalf, so have raised a support ticket and will post back here with the outcome.