OneLogin Parser - OneLogin

[katerobson08]

Describe the bug
I have been trying to use the parser for OneLogin but get an error as there seems to be 7 fields missing form the table(OneLogin_CL).
The fields are:
app_name_s
app_id_d
role_name_s
role_id_d
user_attributes_username_s
user_attributes_department_s
user_attributes_title_s

To Reproduce
Steps to reproduce the behavior:

1. Install OneLogin Parser
2. Go to Sentinel -> Logs
3. Run the parser OneLogin
4. Error "project-rename: Failed to resolve column reference 'app_name_s'"

Expected behavior
To produce parsed table

Screenshots

Fields removed:

Desktop (please complete the following information):

• OS: Windows
• Browser Edge
• Version Version 116.0.1938.62

Smartphone (please complete the following information):

Additional context

[github-actions]

Thank you for submitting an Issue to the Azure Sentinel GitHub repo! You should expect an initial response to your Issue from the team within 5 business days. Note that this response may be delayed during holiday periods. For urgent, production-affecting issues please raise a support ticket via the Azure Portal.

[v-sudkharat]

Hi @katerobson08, thanks for flagging this issue, we will soon get back to you on this. Thanks!

[v-sudkharat]

Hi @katerobson08, can you please share the table schema with us, so we check the failed column in parser. Thanks
Sharing the query to get the schema:

OneLogin_CL
| getschema  

[v-sudkharat]

Hello @katerobson08, hope you are doing well. Can you please share the table schema, so we check the failed column in parser.
Sharing the steps to get the schema.

1. Go to your workspace and click Logs.
2. Run the below mentioned query in Logs
   

Thanks!

[v-sudkharat]

Hi @katerobson08, Gentle Reminder: We are waiting for your response on this issue. If you still need to keep this issue active, please respond on it in the next 2 days. If we don't receive response by 14-09-2023 date, we will be close this issue. Thanks!

[katerobson08]

So sorry, I missed your email. Here is the schema you require. [cid:051a6eeb-d9d4-4954-ae0c-f60d26fcd787] Kate

…

__ Kate Robson Senior Security Engineer (Connectors) +447984320764 ***@***.*** Quorum Cyber Security Limited ​Registered Office: First Floor Suite (West Wing), Verdant, 2 Redheughs Rigg, South Gyle, Edinburgh, EH12 9DQ ​Registered Number: SC510322. Registered in Scotland

________________________________ From: v-sudkharat ***@***.***> Sent: Tuesday, September 12, 2023 9:10 AM To: Azure/Azure-Sentinel ***@***.***> Cc: Kate Robson ***@***.***>; Mention ***@***.***> Subject: [EXTERNAL] - Re: [Azure/Azure-Sentinel] OneLogin Parser - OneLogin (Issue #8912) Caution: This email originated from outside of the organisation. Do not click links or open attachments unless you recognise the sender and know the content is safe. Hi @katerobson08<https://github.com/katerobson08>, Gentle Reminder: We are waiting for your response on this issue. If you still need to keep this issue active, please respond on it in the next 2 days. If we don't receive response by 12-09-2023 date, we will be close this issue. Thanks! — Reply to this email directly, view it on GitHub<#8912 (comment)>, or unsubscribe<https://github.com/notifications/unsubscribe-auth/AXP27ZJGJ77I4H4EB2Q5UVDX2AKF5ANCNFSM6AAAAAA4EXDMNE>. You are receiving this because you were mentioned.Message ID: ***@***.***>

[v-sudkharat]

Hi @katerobson08, we are unable to see the schema shared by you. Can you please re-share the schema by referring above comment? Thanks!

[v-sudkharat]

Hello @katerobson08, Gentle Reminder: We are still waiting for your response on this issue. If you still need to keep this issue active, please respond on it in the next 2 days. If we don't receive response by 20-09-2023 date, we will be close this issue. Thanks!

[v-sudkharat]

Hello @katerobson08, since we have not received a response in the last 5 days, we are closing your issue #8912 as per our standard operating procedures. If you still need support for this issue, feel free to re-open at any time. Thank you for your co-operation.

[katerobson08]

Sorry, hopefully you can see this.

Kate