_Im_NetworkSession_AzureFirewallV02 parser failing
- Dominant language
- Python
- Stars
- 6.1k
- Forks
- 3.8k
- Avg merge
- 4d 7h
- Merged PRs (30d)
- 125
Description
**Describe the bug**
I have come across an issue with the "_Im_NetworkSession_AzureFirewallV02" parser failing in some workspaces: https://github.com/Azure/Azure-Sentinel/blob/3a38a5abe67274b30d672d081d273a512034f28e/Parsers/ASimNetworkSession/Parsers/vimNetworkSessionAzureFirewall.yaml
In some workspaces that do not ingest AzureDiagnostics, it is failing with the error :
"'where' operator: Failed to resolve scalar expression named 'msg_s'"
Adding the line "| extend msg_s = column_ifexists("msg_s", "")" within the AzureDiagnostics logic seems to resolve the issue:
**To Reproduce**
Steps to reproduce the behavior:
1. Go to a workspace that ingests data through one of the other means, but not AzureDiagnostics, e.g. AZFWNetworkRule, AZFWNatRule, AZFWIdpsSignature or AZFWThreatIntel
2. Run the _Im_NetworkSession_AzureFirewallV02 parser function
3. See error
**Expected behavior**
The parser should run successfully, regardless of the logic within the AzureDiagnostics section, if the customer does not ingest the table.
Contributor guide
Assessment
This issue has not been assessed yet.