You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Describe the bug
Unable to deploy UEBA/EntityAnalytics, something wrong with etag reference.
Documentation is invalid.
To Reproduce
repro sample:
paramworkspaceNamestringparamenableUebabool = trueparamenableAnomaliesbool = trueparamenableEntityAnalyticsbool = trueparamenableEyesOnbool = trueparamuebaDataSourcesarray = [ 'AuditLogs''AzureActivity''SecurityEvent''SigninLogs' ]
paramentityAnalyticsEntityProvidersarray = [
'AzureActiveDirectory'
]
resourceworkspace'Microsoft.OperationalInsights/workspaces@2022-10-01'existing = {
name: workspaceName
}
// Name has to be the same as the setting name// Status Message: Setting name 'sentinel-anomalies-settings' should be identical to the setting kind 'Anomalies' (Code:BadRequest)resourcesentinelSettingsUeba'Microsoft.SecurityInsights/settings@2023-04-01-preview' = if (enableUeba) {
name: 'Ueba'scope: workspacekind: 'Ueba'etag: '*'properties: {
dataSources: uebaDataSources
}
} // broken eTag/etag/ETag does not work, also tried 2023-06-01-previewresourcesentinelSettingsEyesOn'Microsoft.SecurityInsights/settings@2023-04-01-preview' = if (enableEyesOn) {
name: 'EyesOn'scope: workspacekind: 'EyesOn'properties: {}
}
resourcesentinelSettingsEntityAnalytics'Microsoft.SecurityInsights/settings@2023-04-01-preview' = if (enableEntityAnalytics) {
name: 'EntityAnalytics'etag: '*'scope: workspacekind: 'EntityAnalytics'properties: {
entityProviders: entityAnalyticsEntityProviders
}
} // broken eTag/etag/ETag does not work, also tried 2023-06-01-previewresourcesentinelSettingsAnomalies'Microsoft.SecurityInsights/settings@2023-04-01-preview' = if (enableAnomalies) {
name: 'Anomalies'scope: workspacekind: 'Anomalies'properties: {}
}
After replacing etag with eTag:
Update request should provide ETag (Code: BadRequest)
For EyesOn/Anomalies deployment works without etag, however for Ueba/EntityAnalytics no dice.
Additional notes
Current documentation is invalid, it tells us to use etag whereas it seems to not be mandatory for 2 of the settings, whereas for 2 where it is required, it simply does not work.
Bicep version
0.16.2
Describe the bug
Unable to deploy UEBA/EntityAnalytics, something wrong with etag reference.
Documentation is invalid.
To Reproduce
repro sample:
After replacing etag with eTag:
For EyesOn/Anomalies deployment works without etag, however for Ueba/EntityAnalytics no dice.
Additional notes
Current documentation is invalid, it tells us to use etag whereas it seems to not be mandatory for 2 of the settings, whereas for 2 where it is required, it simply does not work.
MicrosoftDocs/azure-docs#110169 - docs issue
The text was updated successfully, but these errors were encountered: