Azure / Azure/azure-powershell

`Get-AzSecurityAlert` fails with `Object reference not set to an instance of an object.`

Open
#24,332 4 comments 1 reaction 0 assignees View on GitHub
act-codegen-extensibility-squad bug customer-reported Security Service Attention
Dominant language
C#
Stars
4.8k
Forks
4.3k
Avg merge
2d 17h
Merged PRs (30d)
51

Description

### Description

Az.Security v1.6.0, `Get-AzSecurityDetails` errors with `Object reference not set to an instance of an object.`, even though it successfully gets objects from Azure RM. This happens for one specific subscription, so it doesn't always fail.

Calling the API directly and convert it from JSON works fine. Example:

```powershell
Invoke-AzRestMethod -Method 'Get' -Path ('/subscriptions/{0}/providers/Microsoft.Security/alerts?api-version=2022-01-01' -f (Get-AzContext).'Subscription'.'Id')
```

Maybe related to #23499?

### Issue script & Debug output

Too much sensitive info, don't want to include that here.

After debug shows the raw JSON reply from Azure RM, this is outputted:

```
DEBUG: 10:45:56 - [ConfigManager] Got nothing from [DisableErrorRecordsPersistence], Module = [], Cmdlet = []. Returning default value [False].
DEBUG: 10:45:56 - [ConfigManager] Got nothing from [EnableDataCollection], Module = [], Cmdlet = []. Returning default value [True].
Get-AzSecurityAlert: Object reference not set to an instance of an object.
```

### Environment data

```PowerShell
Name Value
---- -----
PSVersion 7.4.1
PSEdition Core
GitCommitId 7.4.1
OS Microsoft Windows 10.0.22631
Platform Win32NT
PSCompatibleVersions {1.0, 2.0, 3.0, 4.0…}
PSRemotingProtocolVersion 2.3
SerializationVersion 1.1.0.1
WSManStackVersion 3.0
```

### Module versions

```PowerShell
ModuleType Version PreRelease Name ExportedCommands
---------- ------- ---------- ---- ----------------
Script 2.16.0 Az.Accounts {Add-AzEnvironment, Clear-AzConfig, Clear-AzContext, Clear-AzDefault…}
Script 5.2.1 Az.KeyVault {Add-AzKeyVaultCertificate, Add-AzKeyVaultCertificateContact, Add-AzKeyVaultKey, Add-AzKeyVaultManagedStorageAccount…}
Script 6.16.0 Az.Resources {Export-AzResourceGroup, Export-AzTemplateSpec, Get-AzDenyAssignment, Get-AzDeployment…}
Script 1.6.0 Az.Security {Add-AzSecurityAdaptiveNetworkHardening, Add-AzSecuritySqlVulnerabilityAssessmentBaseline, Confirm-AzSecurityAutomation, Disable-AzIotS…
Script 1.1.3 Az.Tools.Predictor {Disable-AzPredictor, Enable-AzPredictor, Open-AzPredictorSurvey, Send-AzPredictorRating}
```

### Error output

```PowerShell
PS > Resolve-AzError -Last

HistoryId: 84

Message : Object reference not set to an instance of an object.
StackTrace : at System.Linq.Enumerable.SelectListIterator`2.Fill(ReadOnlySpan`1 source, Span`1 destination, Func`2 func)
at System.Linq.Enumerable.SelectListIterator`2.ToList()
at Microsoft.Azure.Commands.Security.Models.Alerts.PSSecurityAlertConverters.ConvertToPSType(Alert value)
at System.Linq.Enumerable.SelectEnumerableIterator`2.ToList()
at Microsoft.Azure.Commands.Security.Cmdlets.Alerts.GetAlerts.ExecuteCmdlet()
at Microsoft.WindowsAzure.Commands.Utilities.Common.AzurePSCmdlet.ProcessRecord()
Exception : System.NullReferenceException
InvocationInfo : {Get-AzSecurityAlert}
Line : Get-AzSecurityAlert -Debug
Position : At line:1 char:1
+ Get-AzSecurityAlert -Debug
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~
HistoryId : 84

PS >
```

Contributor guide

Open the contributing guide

Research direction

Start with GetAlerts.ExecuteCmdlet and PSSecurityAlertConverters.ConvertToPSType(Alert value) from the reported stack trace, then inspect the raw Azure Resource Manager alert response for null fields. Reproduce with Get-AzSecurityAlert against an affected subscription and verify that alert conversion completes without the NullReferenceException.

Written by the indexing model from the issue text.

Assessment

Tech stack
csharp, powershell
Domain
backend, security
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Quiet
Clarity
Mostly clear
Newbie friendliness
45/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.