Dynatrace analytic rules not showing as conditions in automation rule

[BSteiner9]

Describe the bug
Analytic rule (Conditions : If Analytic rule name contains 'Dynatrace Application Security - Attack detection') not showing when creating an automation rule, we can see the Analytic rule in templates though.

To Reproduce
Steps to reproduce the behavior:

1. Go to Sentinel
2. Go to Automation
3. New automation rule
4. Analytics rule does not show in available list of conditions

Expected behavior
Expected to see analytics rule as a condition in the automation rule wizard

Screenshots

Desktop (please complete the following information):

• OS: Windows
• Browser: Chrome
• Version 116.0.5845.110

Smartphone (please complete the following information):
N/A

Additional context
We're following the instructions for this playbook, step 3 is where we get stuck:
https://github.com/Azure/Azure-Sentinel/tree/master/Solutions/Dynatrace/Playbooks/Ingest-DynatraceSentinelSecurityAlerts

[github-actions]

Thank you for submitting an Issue to the Azure Sentinel GitHub repo! You should expect an initial response to your Issue from the team within 5 business days. Note that this response may be delayed during holiday periods. For urgent, production-affecting issues please raise a support ticket via the Azure Portal.

[github-actions]

Thank you for submitting an Issue to the Azure Sentinel GitHub repo! You should expect an initial response to your Issue from the team within 5 business days. Note that this response may be delayed during holiday periods. For urgent, production-affecting issues please raise a support ticket via the Azure Portal.

[github-actions]

Thank you for submitting an Issue to the Azure Sentinel GitHub repo! You should expect an initial response to your Issue from the team within 5 business days. Note that this response may be delayed during holiday periods. For urgent, production-affecting issues please raise a support ticket via the Azure Portal.

[github-actions]

Thank you for submitting an Issue to the Azure Sentinel GitHub repo! You should expect an initial response to your Issue from the team within 5 business days. Note that this response may be delayed during holiday periods. For urgent, production-affecting issues please raise a support ticket via the Azure Portal.

[github-actions]

Thank you for submitting an Issue to the Azure Sentinel GitHub repo! You should expect an initial response to your Issue from the team within 5 business days. Note that this response may be delayed during holiday periods. For urgent, production-affecting issues please raise a support ticket via the Azure Portal.

[v-sudkharat]

Hi @BSteiner9, thanks for flagging this issue, we will soon get back to you on this. Thanks!

[v-sudkharat]

Hi @BSteiner9, thanks for flagging this issue, we will soon get back to you on this. Thanks!

[v-sudkharat]

Hi @BSteiner9, the rule does not show when creating as conditions in automation rule because the analytical rule was not created in the "Content Hub". Please install "Dynatrace Software Intelligence Platform" solution from "Content Hub" and create the "Dynatrace Application Security - Attack detection" analytic rule.

Once above rule is successfully created it will show in Automation rule.
Let us know if above step's are working for you.
Thanks!

[v-sudkharat]

Hi @BSteiner9, Gentle Reminder: We are waiting for your response on this issue. If you still need to keep this issue active, please respond on it in the next 2 days. If we don't receive response by 06-09-2023 date, we will be close this issue. Thanks!

[v-sudkharat]

Hi @BSteiner9, since we have not received a response in the last 5 days, we are closing your issue as per our standard operating procedures. If you still need support for this issue, feel free to re-open at any time. Thank you for your co-operation.

[BSteiner9]

Hey @v-sudkharat , thanks for your help! My apologies for the delay on responding.. we're running into an issue when creating the Analytics rule saying that 'Dynatraceattacks_cl data source is missing' - do we have to create something else? Wasn't sure where to find/create a data source or should it import it through the connector?

[v-sudkharat]

Hello @BSteiner9, the 'Dynatraceattacks_cl data source is missing', issue occurs when the table is not created into the Workspace. please can you check once the data connector is created, and status of connector is showing as "Connected".

If Data connector is not created, sharing steps for configure the Data Connector:
Step 1: Go to "Dynatrace Software Intelligence Platform" solution and click on the data connector to configure.

Step 2: while configure the connector go through the Pre-requisites and configure it. Once the data connector status show "Connected" the table will be created into the workspace.

Thanks!

[BSteiner9]

Hey v-sudkharat, appreciate your help on this issue!

We're still unable to pull DynatraceAttacks_cl data source which is not letting us use the analytics rule that was imported after installing the plug-in:

We connected the connector successfully about 1-2 weeks ago but the data source still wasn't generated.

Anything we can do to get this data source?

Thanks,
Brendan

[v-sudkharat]

Hi @BSteiner9, this data connector issue needs to be further investigation. could you please create a support case for this issue? so, support team can connect with you to get more details that are needed about the problem and assist you in fixing it. Thanks!