Change API version for Az.SecurityInsights

Open

#26,146 opened on Sep 20, 2024 3 comments 0 reactions 0 assignees View on GitHub

bug customer-reported needs-triage

Dominant language: C#
Stars: 4.8k
Forks: 4.3k
Avg merge: 2d 17h
Merged PRs (30d): 51

Description

### Description

Hi,
I wanted to use the mentioned module to update my incidents automatically. Unfortunately I always get the following error:
```powershell
Update-AzSentinelIncident -Id $id -Status "Closed" -ResourceGroupName $rgName -WorkspaceName $workspaceName -Classification Undetermined
Update-AzSentinelIncident_UpdateExpanded: No registered resource provider found for location 'westeurope' and API version '2021-09-01-preview' for type 'workspaces'. The supported api-versions are '2015-03-20, 2015-11-01-preview, 2017-01-01-preview, 2017-03-03-preview, 2017-03-15-preview, 2017-04-26-preview, 2020-03-01-preview, 2020-08-01, 2020-10-01, 2021-03-01-privatepreview, 2021-06-01, 2021-12-01-preview, 2022-10-01, 2023-01-01-preview, 2023-09-01'. The supported locations are 'eastus, westeurope, southeastasia, australiasoutheast, westcentralus, japaneast, uksouth, centralindia, canadacentral, westus2, australiacentral, australiaeast, francecentral, koreacentral, northeurope, centralus, eastasia, eastus2, southcentralus, northcentralus, westus, ukwest, southafricanorth, brazilsouth, switzerlandnorth, switzerlandwest, germanywestcentral, australiacentral2, uaecentral, uaenorth, japanwest, brazilsoutheast, norwayeast, norwaywest, francesouth, southindia, koreasouth, jioindiacentral, jioindiawest, qatarcentral, canadaeast, westus3, swedencentral, southafricawest, germanynorth, polandcentral, israelcentral, italynorth, spaincentral'.
```
Resource Provider Microsoft.SecurityInsights and Microsoft.OperationalInsights are registered.
When I check the API versions on SecurityInsights I can see that "2021-09-01-preview" is available but on OperationalInsights it is unavailable on resource type "workspaces" like mentioned in the picture.

If I look at the source: https://github.com/Azure/azure-powershell/blob/main/src/SecurityInsights/SecurityInsights.Autorest/UX/Microsoft.OperationalInsights/workspaces-incidents.json
I can see that API version "2021-09-01-preview" is used. But as I mentioned above this version is not avilable for "workspace" in OperationalInsights:
![image](https://github.com/user-attachments/assets/46416e69-adf8-4e08-8a7a-5a13030ed138)

### Issue script & Debug output

```PowerShell
Update-AzSentinelIncident -Id $id -Status "Closed" -ResourceGroupName $rgName -WorkspaceName $workspaceName -Classification Undetermined
DEBUG: 12:59:44 - [ConfigManager] Got nothing from [DisplaySecretsWarning], Module = [], Cmdlet = []. Returning default value [True].
DEBUG: 12:59:44 - GetAzureRMContextCommand begin processing with ParameterSet 'GetSingleContext'.
DEBUG: 12:59:44 - [ConfigManager] Got nothing from [DisplayBreakingChangeWarning], Module = [], Cmdlet = []. Returning default value [True].
DEBUG: 12:59:44 - [ConfigManager] Got nothing from [DisplaySecretsWarning], Module = [], Cmdlet = []. Returning default value [True].
DEBUG: 12:59:44 - [ConfigManager] Got nothing from [DisplayRegionIdentified], Module = [], Cmdlet = []. Returning default value [True].
DEBUG: 12:59:44 - [ConfigManager] Got nothing from [CheckForUpgrade], Module = [], Cmdlet = []. Returning default value [True].
DEBUG: 12:59:44 - GetAzureRMContextCommand end processing.
DEBUG: [CmdletBeginProcessing]: Starting command
DEBUG: CmdletBeginProcessing:
DEBUG: CmdletProcessRecordStart:
DEBUG: CmdletGetPipeline:
DEBUG: CmdletBeforeAPICall:
DEBUG: URLCreated: /subscriptions/bd50c681-4857-495a-b225-526f2829ab59/resourceGroups/rg-hybrid-ressources/providers/Microsoft.OperationalInsights/workspaces/ak-hybridresources-la/providers/Microsoft.SecurityInsights/incidents/%40%7BId%3D%2Fsubscriptions%2Fbd50c681-4857-495a-b225-526f2829ab59%2FresourceGroups%2Frg-hybrid-ressources%2Fproviders%2FMicrosoft.OperationalInsights%2Fworkspaces%2Fak-hybridresources-la%2Fproviders%2FMicrosoft.SecurityInsights%2FIncidents%2Fa1d77a3f-d396-493d-91b1-c38d8a12d68f%7D?api-version=2021-09-01-preview
DEBUG: RequestCreated: /subscriptions/bd50c681-4857-495a-b225-526f2829ab59/resourceGroups/rg-hybrid-ressources/providers/Microsoft.OperationalInsights/workspaces/ak-hybridresources-la/providers/Microsoft.SecurityInsights/incidents/%40%7BId%3D%2Fsubscriptions%2Fbd50c681-4857-495a-b225-526f2829ab59%2FresourceGroups%2Frg-hybrid-ressources%2Fproviders%2FMicrosoft.OperationalInsights%2Fworkspaces%2Fak-hybridresources-la%2Fproviders%2FMicrosoft.SecurityInsights%2FIncidents%2Fa1d77a3f-d396-493d-91b1-c38d8a12d68f%7D?api-version=2021-09-01-preview
DEBUG: HeaderParametersAdded:
DEBUG: BodyContentSet:
DEBUG: 12:59:44 - [ConfigManager] Got nothing from [DisableInstanceDiscovery], Module = [], Cmdlet = []. Returning default value [False].
DEBUG: ============================ HTTP REQUEST ============================

HTTP Method:
PUT

Absolute Uri:
https://management.azure.com/subscriptions/bd50c681-4857-495a-b225-526f2829ab59/resourceGroups/rg-hybrid-ressources/providers/Microsoft.OperationalInsights/workspaces/ak-hybridresources-la/providers/Microsoft.SecurityInsights/incidents/%40{Id%3D%2Fsubscriptions%2Fbd50c681-4857-495a-b225-526f2829ab59%2FresourceGroups%2Frg-hybrid-ressources%2Fproviders%2FMicrosoft.OperationalInsights%2Fworkspaces%2Fak-hybridresources-la%2Fproviders%2FMicrosoft.SecurityInsights%2FIncidents%2Fa1d77a3f-d396-493d-91b1-c38d8a12d68f}?api-version=2021-09-01-preview

Headers:
x-ms-unique-id : 16
x-ms-client-request-id : 652c8792-4ef3-446e-b6fc-617e7c984aad
CommandName : Update-AzSentinelIncident
FullCommandName : Update-AzSentinelIncident_UpdateExpanded
ParameterSetName : __AllParameterSets
User-Agent : AzurePowershell/v12.3.0,PSVersion/v7.4.5,Az.SecurityInsights/0.0.0

Body:
{
"properties": {
"classification": "Undetermined",
"status": "Closed"
}
}

DEBUG: 12:59:44 - [ConfigManager] Got nothing from [EnableLoginByWam], Module = [], Cmdlet = []. Returning default value [True].
DEBUG: BeforeCall:
DEBUG: ============================ HTTP RESPONSE ============================

Status Code:
BadRequest

Headers:
Cache-Control : no-cache
Pragma : no-cache
x-ms-failure-cause : gateway
x-ms-request-id : 3381be55-ddf5-4a5e-a4ef-b475fc112a5b
x-ms-correlation-request-id : 3381be55-ddf5-4a5e-a4ef-b475fc112a5b
x-ms-routing-request-id : GERMANYWESTCENTRAL:20240920T105945Z:3381be55-ddf5-4a5e-a4ef-b475fc112a5b
Strict-Transport-Security : max-age=31536000; includeSubDomains
X-Content-Type-Options : nosniff
X-Cache : CONFIG_NOCACHE
X-MSEdge-Ref : Ref A: 5D758FE204674FD4837C5D4C2AEEC095 Ref B: FRA231050414029 Ref C: 2024-09-20T10:59:44Z
Date : Fri, 20 Sep 2024 10:59:45 GMT

Body:
{
"error": {
"code": "NoRegisteredProviderFound",
"message": "No registered resource provider found for location 'westeurope' and API version '2021-09-01-preview' for type 'workspaces'. The supported api-versions are '2015-03-20, 2015-11-01-preview, 2017-01-01-preview, 2017-03-03-preview, 2017-03-15-preview, 2017-04-26-preview, 2020-03-01-preview, 2020-08-01, 2020-10-01, 2021-03-01-privatepreview, 2021-06-01, 2021-12-01-preview, 2022-10-01, 2023-01-01-preview, 2023-09-01'. The supported locations are 'eastus, westeurope, southeastasia, australiasoutheast, westcentralus, japaneast, uksouth, centralindia, canadacentral, westus2, australiacentral, australiaeast, francecentral, koreacentral, northeurope, centralus, eastasia, eastus2, southcentralus, northcentralus, westus, ukwest, southafricanorth, brazilsouth, switzerlandnorth, switzerlandwest, germanywestcentral, australiacentral2, uaecentral, uaenorth, japanwest, brazilsoutheast, norwayeast, norwaywest, francesouth, southindia, koreasouth, jioindiacentral, jioindiawest, qatarcentral, canadaeast, westus3, swedencentral, southafricawest, germanynorth, polandcentral, israelcentral, italynorth, spaincentral'."
}
}

DEBUG: ResponseCreated:
DEBUG: BeforeResponseDispatch:
Update-AzSentinelIncident_UpdateExpanded: No registered resource provider found for location 'westeurope' and API version '2021-09-01-preview' for type 'workspaces'. The supported api-versions are '2015-03-20, 2015-11-01-preview, 2017-01-01-preview, 2017-03-03-preview, 2017-03-15-preview, 2017-04-26-preview, 2020-03-01-preview, 2020-08-01, 2020-10-01, 2021-03-01-privatepreview, 2021-06-01, 2021-12-01-preview, 2022-10-01, 2023-01-01-preview, 2023-09-01'. The supported locations are 'eastus, westeurope, southeastasia, australiasoutheast, westcentralus, japaneast, uksouth, centralindia, canadacentral, westus2, australiacentral, australiaeast, francecentral, koreacentral, northeurope, centralus, eastasia, eastus2, southcentralus, northcentralus, westus, ukwest, southafricanorth, brazilsouth, switzerlandnorth, switzerlandwest, germanywestcentral, australiacentral2, uaecentral, uaenorth, japanwest, brazilsoutheast, norwayeast, norwaywest, francesouth, southindia, koreasouth, jioindiacentral, jioindiawest, qatarcentral, canadaeast, westus3, swedencentral, southafricawest, germanynorth, polandcentral, israelcentral, italynorth, spaincentral'.
DEBUG: [Finally]: Getting exception 'Microsoft.Azure.Commands.Common.Exceptions.AzPSCloudException: InternalException' from response
DEBUG: Finally:
DEBUG: CmdletAfterAPICall:
DEBUG: [CmdletProcessRecordAsyncEnd]: Finish HTTP process
DEBUG: CmdletProcessRecordAsyncEnd:
DEBUG: CmdletProcessRecordEnd:
DEBUG: AzureQoSEvent: Module: Az.SecurityInsights:3.1.2; CommandName: Update-AzSentinelIncident; PSVersion: 7.4.5; IsSuccess: False; Duration: 00:00:00.9845318; SanitizeDuration: 00:00:00; Exception: InternalException;
```

### Environment data

```PowerShell
$PSVersionTable

Name Value
---- -----
PSVersion 7.4.5
PSEdition Core
GitCommitId 7.4.5
OS Microsoft Windows 10.0.22631
Platform Win32NT
PSCompatibleVersions {1.0, 2.0, 3.0, 4.0…}
PSRemotingProtocolVersion 2.3
SerializationVersion 1.1.0.1
WSManStackVersion 3.0
```

### Module versions

```PowerShell
Get-Module Az*

ModuleType Version PreRelease Name ExportedCommands
---------- ------- ---------- ---- ----------------
Script 3.0.4 Az.Accounts {Add-AzEnvironment, Clear-AzConfig, Clear-AzContext, Clear-AzDefault…}
Script 7.4.0 Az.Resources {Export-AzResourceGroup, Export-AzTemplateSpec, Get-AzDenyAssignment, Get-AzDeployment…}
Script 3.1.2 Az.SecurityInsights {Get-AzSentinelAlertRule, Get-AzSentinelAlertRuleAction, Get-AzSentinelAlertRuleTemplate, Get-AzSentinelAutomationRule…}
```

### Error output

```PowerShell
Resolve-AzError
DEBUG: 13:00:46 - [ConfigManager] Got nothing from [DisplaySecretsWarning], Module = [], Cmdlet = []. Returning default value [True].
DEBUG: 13:00:46 - ResolveError begin processing with ParameterSet 'AnyErrorParameterSet'.
DEBUG: 13:00:46 - using account id '[username]@[mydomain.tld]'...
DEBUG: 13:00:46 - [ConfigManager] Got nothing from [DisplayBreakingChangeWarning], Module = [], Cmdlet = []. Returning default value [True].
DEBUG: 13:00:46 - [ConfigManager] Got nothing from [DisplaySecretsWarning], Module = [], Cmdlet = []. Returning default value [True].

HistoryId: 18

Message : [NoRegisteredProviderFound] : No registered resource provider found for location 'westeurope' and API version '2021-09-01-preview' for type 'workspaces'. The supported api-versions are
'2015-03-20, 2015-11-01-preview, 2017-01-01-preview, 2017-03-03-preview, 2017-03-15-preview, 2017-04-26-preview, 2020-03-01-preview, 2020-08-01, 2020-10-01, 2021-03-01-privatepreview,
2021-06-01, 2021-12-01-preview, 2022-10-01, 2023-01-01-preview, 2023-09-01'. The supported locations are 'eastus, westeurope, southeastasia, australiasoutheast, westcentralus, japaneast,
uksouth, centralindia, canadacentral, westus2, australiacentral, australiaeast, francecentral, koreacentral, northeurope, centralus, eastasia, eastus2, southcentralus, northcentralus, westus,
ukwest, southafricanorth, brazilsouth, switzerlandnorth, switzerlandwest, germanywestcentral, australiacentral2, uaecentral, uaenorth, japanwest, brazilsoutheast, norwayeast, norwaywest,
francesouth, southindia, koreasouth, jioindiacentral, jioindiawest, qatarcentral, canadaeast, westus3, swedencentral, southafricawest, germanynorth, polandcentral, israelcentral, italynorth,
spaincentral'.
StackTrace :
Exception : System.Exception
InvocationInfo : {Update-AzSentinelIncident_UpdateExpanded}
Line : Update-AzSentinelIncident -Id $id -Status "Closed" -ResourceGroupName $rgName -WorkspaceName $workspaceName -Classification Undetermined
Position : At line:1 char:1
+ Update-AzSentinelIncident -Id $id -Status "Closed" -ResourceGroupName …
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
HistoryId : 18

DEBUG: 13:00:46 - [ConfigManager] Got nothing from [DisplaySecretsWarning], Module = [], Cmdlet = []. Returning default value [True].

HistoryId: 15

DEBUG: 13:00:46 - [ConfigManager] Got nothing from [DisplaySecretsWarning], Module = [], Cmdlet = []. Returning default value [True].

HistoryId: 11

DEBUG: 13:00:46 - [ConfigManager] Got nothing from [DisplaySecretsWarning], Module = [], Cmdlet = []. Returning default value [True].

HistoryId: 8

DEBUG: 13:00:46 - [ConfigManager] Got nothing from [DisplayRegionIdentified], Module = [], Cmdlet = []. Returning default value [True].
DEBUG: 13:00:46 - [ConfigManager] Got nothing from [CheckForUpgrade], Module = [], Cmdlet = []. Returning default value [True].
DEBUG: AzureQoSEvent: Module: Az.Accounts:3.0.4; CommandName: Resolve-AzError; PSVersion: 7.4.5; IsSuccess: True; Duration: 00:00:00.0952190; SanitizeDuration: 00:00:00.0019098
DEBUG: 13:00:46 - [ConfigManager] Got nothing from [EnableDataCollection], Module = [], Cmdlet = []. Returning default value [True].
DEBUG: 13:00:47 - ResolveError end processing.
```

Contributor guide

Open the contributing guide

Research direction

Start with src/SecurityInsights/SecurityInsights.Autorest/UX/Microsoft.OperationalInsights/workspaces-incidents.json and the Update-AzSentinelIncident entry point. Compare the API version used there with the versions supported for OperationalInsights workspaces, then verify that the generated request targets a supported version and the incident update succeeds.

Written by the indexing model from the issue text.

Assessment

Tech stack: azure, powershell
Domain: api, cloud, security
Issue type: Bug
Difficulty: 3/5
Estimated time: 1-2 days
Activity status: Stale
Clarity: Mostly clear
Newbie friendliness: 45/100

Change API version for Az.SecurityInsights

Description

Contributor guide

Research direction

Assessment

Get new issues in your inbox