Exception: Invalid key: 5 for enum <enum 'EvidenceVerdict'>

[iargue]

When trying to expand an incident with alerts via this code:

incidents_params = IncidentsRequestBuilder.IncidentsRequestBuilderGetQueryParameters(
            filter=f"createdDateTime gt {startTime:%Y-%m-%d}T00:00:00Z and severity ne 'low' and severity ne 'informational'",
            expand=["alerts"],
        )

incidents_config = IncidentsRequestBuilder.IncidentsRequestBuilderGetRequestConfiguration(
            query_parameters=incidents_params
        )

try:
    incidentsRequest = await self.client.security.incidents.get(request_configuration=incidents_config)

Full traceback

Traceback (most recent call last):
  File "graph.py", line 236, in get_unfamiliarsignin
    incidentsRequest = await self.adapter.send_async(request_info, IncidentCollectionResponse, {})  # type: ignore
                       ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "C:\Program Files\Python311\Lib\site-packages\kiota_http\httpx_request_adapter.py", line 123, in send_async
    result = root_node.get_object_value(model_type)
             ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "C:\Program Files\Python311\Lib\site-packages\kiota_serialization_json\json_parse_node.py", line 228, in get_object_value
    self._assign_field_values(result)
  File "C:\Program Files\Python311\Lib\site-packages\kiota_serialization_json\json_parse_node.py", line 287, in _assign_field_values
    deserializer(JsonParseNode(val))
  File "C:\Program Files\Python311\Lib\site-packages\msgraph\generated\models\security\incident_collection_response.py", line 41, in <lambda>
    "value": lambda n : setattr(self, 'value', n.get_collection_of_object_values(incident.Incident)),
                                               ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "C:\Program Files\Python311\Lib\site-packages\kiota_serialization_json\json_parse_node.py", line 180, in get_collection_of_object_values
    return list(
           ^^^^^
  File "C:\Program Files\Python311\Lib\site-packages\kiota_serialization_json\json_parse_node.py", line 182, in <lambda>
    lambda x: JsonParseNode(x).get_object_value(factory),  # type: ignore
              ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "C:\Program Files\Python311\Lib\site-packages\kiota_serialization_json\json_parse_node.py", line 228, in get_object_value
    self._assign_field_values(result)
  File "C:\Program Files\Python311\Lib\site-packages\kiota_serialization_json\json_parse_node.py", line 287, in _assign_field_values
    deserializer(JsonParseNode(val))
  File "C:\Program Files\Python311\Lib\site-packages\msgraph\generated\models\security\incident.py", line 206, in <lambda>
    "alerts": lambda n : setattr(self, 'alerts', n.get_collection_of_object_values(alert.Alert)),
                                                 ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "C:\Program Files\Python311\Lib\site-packages\kiota_serialization_json\json_parse_node.py", line 180, in get_collection_of_object_values
    return list(
           ^^^^^
  File "C:\Program Files\Python311\Lib\site-packages\kiota_serialization_json\json_parse_node.py", line 182, in <lambda>
    lambda x: JsonParseNode(x).get_object_value(factory),  # type: ignore
              ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "C:\Program Files\Python311\Lib\site-packages\kiota_serialization_json\json_parse_node.py", line 228, in get_object_value
    self._assign_field_values(result)
  File "C:\Program Files\Python311\Lib\site-packages\kiota_serialization_json\json_parse_node.py", line 287, in _assign_field_values
    deserializer(JsonParseNode(val))
  File "C:\Program Files\Python311\Lib\site-packages\msgraph\generated\models\security\alert.py", line 330, in <lambda>
    "evidence": lambda n : setattr(self, 'evidence', n.get_collection_of_object_values(alert_evidence.AlertEvidence)),
                                                     ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "C:\Program Files\Python311\Lib\site-packages\kiota_serialization_json\json_parse_node.py", line 180, in get_collection_of_object_values
    return list(
           ^^^^^
  File "C:\Program Files\Python311\Lib\site-packages\kiota_serialization_json\json_parse_node.py", line 182, in <lambda>
    lambda x: JsonParseNode(x).get_object_value(factory),  # type: ignore
              ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "C:\Program Files\Python311\Lib\site-packages\kiota_serialization_json\json_parse_node.py", line 228, in get_object_value
    self._assign_field_values(result)
  File "C:\Program Files\Python311\Lib\site-packages\kiota_serialization_json\json_parse_node.py", line 287, in _assign_field_values
    deserializer(JsonParseNode(val))
  File "C:\Program Files\Python311\Lib\site-packages\msgraph\generated\models\security\alert_evidence.py", line 151, in <lambda>
    "verdict": lambda n : setattr(self, 'verdict', n.get_enum_value(evidence_verdict.EvidenceVerdict)),
                                                   ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "C:\Program Files\Python311\Lib\site-packages\kiota_serialization_json\json_parse_node.py", line 217, in get_enum_value
    raise Exception(f'Invalid key: {camel_case_key} for enum {enum_class}.')
Exception: Invalid key: 5 for enum <enum 'EvidenceVerdict'>.

[0xliam]

I've also recently encountered this issue with one of my tenants. It only happened on one or two incidents, but the 5 value seems to be completely undocumented and potentially a bug with Graph itself, rather than the SDK.

https://learn.microsoft.com/en-us/graph/api/resources/security-alertevidence?view=graph-rest-1.0#evidenceverdict-values

Is there someone at Microsoft I can reach out to with the alert and tenant ID to assist troubleshooting?

[DefenderAPINinja]

I get the same error when trying to get all alerts from the alerts_v2 endpoint.

Exception has occurred: Exception Invalid key: 5 for enum <enum 'EvidenceVerdict'>. KeyError: '5'

During handling of the above exception, another exception occurred:

File "/mnt/c/source/m365defender/get-m365alerts.py", line 19, in list_alerts result = await client.security.alerts_v2.get() File "/mnt/c/source/m365defender/get-m365alerts.py", line 22, in alerts = asyncio.run(list_alerts()) Exception: Invalid key: 5 for enum <enum 'EvidenceVerdict'>.

[joaooliveira-proof]

Im also facing this issue

[0xliam]

As mentioned in my comment above, I don't believe this is an SDK bug, but rather a bug in the Graph API spec.

5 is not a valid EvidenceVerdict member in the API specifications, so Kiota is correctly raising an Exception.

It would be much appreciated if someone from MSFT could point me in the right place to submit a bug report for Graph itself.

[DefenderAPINinja]

Not sure if it is just me. But for my usecase the error is gone. Can you check again if it also works for you?

[rauburtin]

I have exactly the same pb. I saw also the issue in the Golang SDK. https://github.com/microsoftgraph/msgraph-sdk-go/issues/555. A comment states

" I don't believe this is an SDK bug, but rather a bug in the Graph API spec."

In any case, the SDK should be able to handle errors from the API. I fixed the problem with a horrible hack in kiota_serialization_json\json_parse_node.py at line 199 in order to get the alerts

        try:
            #hack
            if camel_case_key == '5':
                return enum_class['Unknown']
            return enum_class[camel_case_key] # type: ignore
        except KeyError:
            raise Exception(f'Invalid key: {camel_case_key} for enum {enum_class}.')