Azure / Azure/azure-rest-api-specs
Microsoft.SecurityInsights api-version 2019-01-01 - ThreatIntelligenceAlertRuleProperties - Severity/displayName is not ReadOnly
- Dominant language
- TypeSpec
- Stars
- 3.1k
- Forks
- 5.9k
- Avg merge
- 3d 2h
- Merged PRs (30d)
- 424
Description
While Implementing the securityinsight.ThreatIntelligenceAlertRule type, there appears to be a mismatch from the API Spec and the actual backend. Recieved below error when creating an alert rule from template
```
{"kind":"ThreatIntelligence","properties":{"alertRuleTemplateName":"0dd422ee-e6af-4204-b219-f59ac172e4c6","enabled":false}}
2021/05/02 10:27:22 [DEBUG] AzureRM Response for https://management.azure.com/subscriptions/[redacted]/resourceGroups/acctestRG-sentinel-210502102421773467/providers/Microsoft.OperationalInsights/workspaces/acctestLAW-210502102421773467/providers/Microsoft.SecurityInsights/alertRules/acctest-SentinelAlertRule-ThreatIntelligence-210502102421773467?api-version=2019-01-01-preview:
HTTP/2.0 400 Bad Request
-- snipped --
{"error":{"code":"BadRequest","message":"Required property 'severity' not found in JSON. Path 'properties', line 3, position 17."}}
```
This appears to be implemented correctly as readonly in the Go SDK [here](https://github.com/Azure/azure-sdk-for-go/blob/master/services/preview/securityinsight/mgmt/2019-01-01-preview/securityinsight/models.go#L17812) - From this im guessing this must be a backend issue. severity and displayName should both be readonly although are required. See below of a succesful API Request:

https://github.com/Azure/azure-rest-api-specs/blob/dceaa75fe47854ad7b0fcc0c7cf38677b4bb181f/specification/securityinsights/resource-manager/Microsoft.SecurityInsights/preview/2019-01-01-preview/SecurityInsights.json#L9021
Contributor guide
Research direction
Start at SecurityInsights.json around line 9021 and compare the ThreatIntelligenceAlertRuleProperties definition with the linked Go SDK models.go implementation. Verify whether severity and displayName are marked read-only while still required, and determine whether the mismatch belongs in the specification or the backend. Done means the API contract and generated behavior consistently reflect the observed request requirements.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- openapi
- Domain
- api
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Clearly specified
- Newbie friendliness
- 35/100