New Mimecast (3.0.1) Function App based data connectors change Workspace default log retention to 30 days (typically 90 days) causing all tables retention to be changed/reduced

[PCNZ]

Describe the bug
After deploying any of the new Mimecast data connectors (Mimecast Audit Logs, Mimecast Cloud Gateway MTA, Mimecast Cloud Gateway Targeted Threat Protection or Mimecast Cloud Gateway Threat Intel Regional Feed) the default log retention of the Workspace specified during deployment of the function app is set to 30 days. The deployment overwrites the existing retention setting of the workspace, which is typically 90 days.
It should not be changing the retention of the workspace at all.
The result is that all tables which are using the default retention period, have logs retention significantly reduced.

To Reproduce
Steps to reproduce the behavior:

1. Check the log retention on your existing Sentinel Workspace (typically 90 days)
2. Install one of the Mimecast contents from the Content Hub ((Mimecast Audit Logs, Mimecast Cloud Gateway MTA, Mimecast Cloud Gateway Targeted Threat Protection or Mimecast Cloud Gateway Threat Intel Regional Feed)
3. Open Data Connectors and the new Mimecast data connector
4. Select "Deploy to Azure" to deploy the function app.
5. In the Custom deployment page select a Sentinel workspace which has a retention period other than 30 days
6. Deploy the function app (doesn't require valid Mimecast details at this point as change to workspace retention happens regardless)
7. Check the log retention on your existing Sentinel Workspace, observe it has changed to 30 days.

Expected behavior
Sentinel Workspace Default Log Retentions are not changed when a data connector is deployed.

Screenshots
Function app deployment setting retention to 30 days.

Desktop (please complete the following information):

• OS: Windows 11
• Browser Edge
• Version 120.0.2210.133 (Official build) (64-bit)

Additional context
Anyone who has deployed this data connector should check and reset their default log retentions to avoid unexpected data loss.
Please add code checks to all Sentinel pull requests, to prevent future data connectors being deployed which exhibit this behaviour.

[github-actions]

Thank you for submitting an Issue to the Azure Sentinel GitHub repo! You should expect an initial response to your Issue from the team within 5 business days. Note that this response may be delayed during holiday periods. For urgent, production-affecting issues please raise a support ticket via the Azure Portal.

[v-muuppugund]

Hi @PCNZ , Thanks for flagging this issue, we will investigate this issue and get back to you with some updates by 23Jan2024. Thanks!

[v-sudkharat]

Hi @PCNZ, thanks for reporting this bug with us. We have checked the solution, the Mimecast solution is partner supported with the Mimecast Team, and as of now we are not authorized to make those modification in function app. but i can see you have raised the PR-(#9781) with those changes, we really appreciate your contribution on this.

We will check this issue with our team and get back to you by some updates. Thanks!

[PCNZ]

Hi @PCNZ, thanks for reporting this bug with us. We have checked the solution, the Mimecast solution is partner supported with the Mimecast Team, and as of now we are not authorized to make those modification in function app. but i can see you have raised the PR-(#9781) with those changes, we really appreciate your contribution on this.

We will check this issue with our team and get back to you by some updates. Thanks!

Thanks, I have also emailed the Mimecast support email address listed in the solution (support@mimecast.com) but it responds saying that it is no longer used/monitored.

[v-sudkharat]

Hi @PCNZ, thank you for response. Could you please check with below shared link and raise case with Mimecast. So Mimecast team will can check on this issue and made those modification's.
Sharing the Mimecast support link -
Link - "https://community.mimecast.com/s/contactsupport"
We are closing this issue from GitHub. If you still need support for this issue, feel free to re-open it any time. Thank you for your co-operation.

[PCNZ]

Hi @PCNZ, thank you for response. Could you please check with below shared link and raise case with Mimecast. So Mimecast team will can check on this issue and made those modification's. Sharing the Mimecast support link - Link - "https://community.mimecast.com/s/contactsupport" We are closing this issue from GitHub. If you still need support for this issue, feel free to re-open it any time. Thank you for your co-operation.

Seems you need to be a customer and have a registered domain with Mimecast to be able to access that support, which I don't have.

[PCNZ]

@v-sudkharat I don't seem to have access to re-open this, can you please leave it open until it is resolved. To let users know the bug still exists and give them the opportunity to work around it.

[v-sudkharat]

Hi @PCNZ, Apologies for the delay in response. Unfortunately, we cannot keep this partner-supported solution open. As mentioned above, we are not authorized to do so. Therefore, we kindly request the customer to open a case with Mimecast so that they can make the required changes.

Thanks!

[PCNZ]

@nipun-crestdatasystem
@SmitR01
Sorry to ping you directly, but you involved with the development of this still?

[nipun-crestdatasystem]

@PCNZ yes we are in discussion with Mimecast on this.

[PCNZ]

This has been fixed now.
d306787