Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Missing requiredDataConnectors in analytic rules #8905

Closed
Kaloszer opened this issue Aug 30, 2023 · 3 comments · Fixed by #8908
Closed

Missing requiredDataConnectors in analytic rules #8905

Kaloszer opened this issue Aug 30, 2023 · 3 comments · Fixed by #8908
Assignees

Comments

@Kaloszer
Copy link

Describe the bug
Analytic rules contain the requiredDataConnectors property - which should reflect required connectors and tables used for queries. However, some of them do not contain everything required for them.

Eg.
https://github.com/Azure/Azure-Sentinel/blob/master/Detections/MultipleDataSources/RunCommandUEBABreach.yaml

Requires BehaviorAnalytics table to be available which is part of UEBA, no BehaviorAnalytics in requiredDataConnectors

Eg. where this is used in the query and it exists in the aforementioned field
https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Azure%20Active%20Directory/Analytic%20Rules/SuccessThenFail_DiffIP_SameUserandApp.yaml

To Reproduce

Try to deploy RunCommandUEBABreach.yaml with BehaviorAnalytics table missing

Expected behavior

Every required data source to run a query should be available in the rule definition. If it is not required for the query to execute it should not be there.

Additional context
This can be used to validate whether an analytic rule would be successful in deploying to an environment or would fail due to a missing table.

@github-actions
Copy link
Contributor

Thank you for submitting an Issue to the Azure Sentinel GitHub repo! You should expect an initial response to your Issue from the team within 5 business days. Note that this response may be delayed during holiday periods. For urgent, production-affecting issues please raise a support ticket via the Azure Portal.

@Kaloszer
Copy link
Author

Added what I found initially into #8908. But I suppose that if I found a few there's more that have a similar issue.

@v-sudkharat
Copy link
Contributor

Hi @Kaloszer, thanks for flagging this issue, we will soon get back to you on this. Thanks!

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging a pull request may close this issue.

4 participants