Azure / Azure/Azure-Sentinel

_Im_NetworkSession_AzureFirewallV02 parser failing

Open
#15,045 2 comments 0 reactions 3 assignees Claimed by @hunngu-ms View on GitHub
ASIM Parser
Dominant language
Python
Stars
6.1k
Forks
3.8k
Avg merge
4d 7h
Merged PRs (30d)
125

Description

**Describe the bug**
I have come across an issue with the "_Im_NetworkSession_AzureFirewallV02" parser failing in some workspaces: https://github.com/Azure/Azure-Sentinel/blob/3a38a5abe67274b30d672d081d273a512034f28e/Parsers/ASimNetworkSession/Parsers/vimNetworkSessionAzureFirewall.yaml

In some workspaces that do not ingest AzureDiagnostics, it is failing with the error :
"'where' operator: Failed to resolve scalar expression named 'msg_s'"

Image

Adding the line "| extend msg_s = column_ifexists("msg_s", "")" within the AzureDiagnostics logic seems to resolve the issue:

Image

**To Reproduce**
Steps to reproduce the behavior:
1. Go to a workspace that ingests data through one of the other means, but not AzureDiagnostics, e.g. AZFWNetworkRule, AZFWNatRule, AZFWIdpsSignature or AZFWThreatIntel
2. Run the _Im_NetworkSession_AzureFirewallV02 parser function
3. See error

**Expected behavior**
The parser should run successfully, regardless of the logic within the AzureDiagnostics section, if the customer does not ingest the table.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.