Content Hub Solution has not correct version (KQL)

[TJ1512]

Describe the bug
When installing the Content Hub Solution "KQL Training" the Solution is not installing the correct version of the workbook "Intro to KQL". My guess is that it is installing an outdated version like this one here instead of the current properly working Workbook from here.

To Reproduce
Steps to reproduce the behavior:

1. Go to 'Content Hub'
2. Click on 'Install KQL Training Solution'
3. Open Workbook "Intro to KQL"
4. See a wrong output of the json when opening the "json" within the first parameters. And also the Selection for Section is not working properly because here it seems like the query is faulty and the json output is not correct.

Expected behaviour

• Installation of the correct workbook version (there is no update available either)

The settings should look like -> Parameter field style: multiline and text editor language: json instead of the values as in the following picture

And for the "Select Section" it should be like:

instead of

so it is possible to choose the Section:

Desktop (please complete the following information):

• OS: MacOS Ventura 13.5.2
• Browser: Safari v16.6

[github-actions]

Thank you for submitting an Issue to the Azure Sentinel GitHub repo! You should expect an initial response to your Issue from the team within 5 business days. Note that this response may be delayed during holiday periods. For urgent, production-affecting issues please raise a support ticket via the Azure Portal.

[v-sudkharat]

Hi @TJ1512, thanks for flagging this issue, we will soon get back to you on this. Thanks!

[v-rbajaj]

Hi @TJ1512,
Wanted to confirm on few things
Are you trying to have Parameter field style: multiline as default ?
And can you please let us know what are you trying to achieve here, so that we can guide you accordingly?

[TJ1512]

Hi @v-rbajaj, so first: Yes, I think it is supposed to be multiple line by default if we look here. I would also expect that this is the version we should get from the download of the solution via content hub. So that is why I think something is not working properly when downloading the Solution via the content hub.

When the Solution is downloaded, the workbook shows that it is set to standard and not multiline (see picture), furthermore the Query for getting the Data of the json (see picture) is also not correct. It should be "print tab = todynamic({json:value})" and not "datatable(tab:string)["{json:escapejson}"]" which it is when downloading the solution.

So for me it looks like the solution is still using an deprecated version like the one here instead of the correct version which is working when I download it manually from here.

I hope that made things a bit more clear.

[v-rbajaj]

Hi @TJ1512, thanks for the details, we will investigate and get back to you by 22 Sep 2023.

[v-rbajaj]

Hi @TJ1512, we are still investigating on this issue, sorry for delay.

[v-rbajaj]

Hi @TJ1512, we are still investigating on this issue, sorry for delay will update you by 17 Oct 2023

[v-sudkharat]

Hi @v-rbajaj, so first: Yes, I think it is supposed to be multiple line by default if we look here. I would also expect that this is the version we should get from the download of the solution via content hub. So that is why I think something is not working properly when downloading the Solution via the content hub.

When the Solution is downloaded, the workbook shows that it is set to standard and not multiline (see picture), furthermore the Query for getting the Data of the json (see picture) is also not correct. It should be "print tab = todynamic({json:value})" and not "datatable(tab:string)["{json:escapejson}"]" which it is when downloading the solution.

So for me it looks like the solution is still using an deprecated version like the one here instead of the correct version which is working when I download it manually from here.

I hope that made things a bit more clear.

Hello @TJ1512, We apologies for the delay and appreciate you giving us the information.
We modified the Solution template by adding the correct workbook (link) version.
Could you please Custom Deploy the below shared MainTemplate in your workspace and check it working fine for you.

Sharing the custom deployment steps documentation- https://learn.microsoft.com/en-us/azure/azure-resource-manager/templates/quickstart-create-templates-use-the-portal

MainTemplate Zip - mainTemplate.zip

Kindly notify us if this issue persists.

Thanks!

[TJ1512]

Hi @v-sudkharat, thank you first! It seems like it is working now when downloading and setting the solution up from the content hub, but when I want to install the provided MainTemplate.json it does not work properly, it gives me the following error and I don't really get it:
{
"code": "InvalidTemplate",
"message": "Deployment template validation failed: 'The template resource '/Microsoft.SecurityInsights/-wb-d53f4nb6olnp2' for type 'Microsoft.OperationalInsights/workspaces/providers/contentTemplates' at line '77' and column '87' has incorrect segment lengths. A nested resource type must have identical number of segments as its resource name. A root resource type must have segment length one greater than its resource name. Please see https://aka.ms/arm-syntax-resources for usage details.'."
}

[v-sudkharat]

Hi @TJ1512, thank you for your response, Could you please redeploy the MainTemplate.json by below steps.

• Go to Custom Deployment

-Add the Workspace details in template-

-Click Create

• Check the Deployment

Once above steps done, check workbook in solution and let us know it works or not. So, we can raise the PR with those changes.

Thanks!

[TJ1512]

Thanks for the instruction, this time it worked. Workbook is working properly now.

[v-sudkharat]

@TJ1512, thanks for confirmation. Can we close this issue?

[TJ1512]

@v-sudkharat, yes, thank you for the support 👍

[v-sudkharat]

@TJ1512, Ok. Thank you!