Azure / Azure/Azure-Network-Security

Sentinel Playbook - Block IP - New | BadRequest The value cannot be null. The action type 'AppendToArrayVariable' only supports values of types 'Float, Integer, String, Boolean, Object'.

Open
#361 1 comment 0 reactions 1 assignee Claimed by @shabaz-github View on GitHub
Dominant language
PowerShell
Stars
942
Forks
360
PR merge metrics
No merged PRs in 30d

Description

**Describe the bug**
I have deployed [Sentinel Playbook - Block IP - New](https://github.com/Azure/Azure-Network-Security/tree/master/Azure%20WAF/Playbook%20-%20WAF%20Sentinel%20Playbook%20Block%20IP%20-%20New) however when the logic app runs it is failing on For Each 4 / Append to array variable 4, generating the BadRequest error below:

BadRequest
The value cannot be null. The action type 'AppendToArrayVariable' only supports values of types 'Float, Integer, String, Boolean, Object'.

The code view for Append to array variable 4 is:
```
{
"type": "AppendToArrayVariable",
"inputs": {
"name": "MatchValue",
"value": "@items('For_each_4')?['Address']"
}
}

```
**Reproduce**
Sentinel has a rule configured to run when a block action is matched in Application Gateway WAF which in turn causes this logic app to run.

**Expected behavior**
I am expecting the IP that was the source of the Block action to be added to the WAF IP block list

**Screenshots**
![image](https://github.com/Azure/Azure-Network-Security/assets/24994600/ac2465bd-6630-4f67-b6c1-47d6d26da2fd)

![image](https://github.com/Azure/Azure-Network-Security/assets/24994600/1ab98bac-0976-475c-92c3-be130a005316)

![image](https://github.com/Azure/Azure-Network-Security/assets/24994600/dc115b1f-6cc4-4782-a0b5-b64c97f01c78)

I'm at a loss as to how to solve this one, hopefully I am missing the obvious - any suggestions appreciated.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.