You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Describe the bug
Analytic rules contain the requiredDataConnectors property - which should reflect required connectors and tables used for queries. However, some of them do not contain everything required for them.
Try to deploy RunCommandUEBABreach.yaml with BehaviorAnalytics table missing
Expected behavior
Every required data source to run a query should be available in the rule definition. If it is not required for the query to execute it should not be there.
Additional context
This can be used to validate whether an analytic rule would be successful in deploying to an environment or would fail due to a missing table.
The text was updated successfully, but these errors were encountered:
Thank you for submitting an Issue to the Azure Sentinel GitHub repo! You should expect an initial response to your Issue from the team within 5 business days. Note that this response may be delayed during holiday periods. For urgent, production-affecting issues please raise a support ticket via the Azure Portal.
Describe the bug
Analytic rules contain the requiredDataConnectors property - which should reflect required connectors and tables used for queries. However, some of them do not contain everything required for them.
Eg.
https://github.com/Azure/Azure-Sentinel/blob/master/Detections/MultipleDataSources/RunCommandUEBABreach.yaml
Requires BehaviorAnalytics table to be available which is part of UEBA, no BehaviorAnalytics in requiredDataConnectors
Eg. where this is used in the query and it exists in the aforementioned field
https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Azure%20Active%20Directory/Analytic%20Rules/SuccessThenFail_DiffIP_SameUserandApp.yaml
To Reproduce
Try to deploy
RunCommandUEBABreach.yaml
with BehaviorAnalytics table missingExpected behavior
Every required data source to run a query should be available in the rule definition. If it is not
required
for the query to execute it should not be there.Additional context
This can be used to validate whether an analytic rule would be successful in deploying to an environment or would fail due to a missing table.
The text was updated successfully, but these errors were encountered: