Azure / Azure/azure-rest-api-specs

Microsoft.SecurityInsights api-version 2019-01-01 - ThreatIntelligenceAlertRuleProperties - Severity/displayName is not ReadOnly

Open
#14,213 2 comments 0 reactions 0 assignees View on GitHub
question SecurityInsights Service Attention
Dominant language
TypeSpec
Stars
3.1k
Forks
5.9k
Avg merge
3d 2h
Merged PRs (30d)
424

Description

While Implementing the securityinsight.ThreatIntelligenceAlertRule type, there appears to be a mismatch from the API Spec and the actual backend. Recieved below error when creating an alert rule from template

```

{"kind":"ThreatIntelligence","properties":{"alertRuleTemplateName":"0dd422ee-e6af-4204-b219-f59ac172e4c6","enabled":false}}
2021/05/02 10:27:22 [DEBUG] AzureRM Response for https://management.azure.com/subscriptions/[redacted]/resourceGroups/acctestRG-sentinel-210502102421773467/providers/Microsoft.OperationalInsights/workspaces/acctestLAW-210502102421773467/providers/Microsoft.SecurityInsights/alertRules/acctest-SentinelAlertRule-ThreatIntelligence-210502102421773467?api-version=2019-01-01-preview:
HTTP/2.0 400 Bad Request
-- snipped --

{"error":{"code":"BadRequest","message":"Required property 'severity' not found in JSON. Path 'properties', line 3, position 17."}}
```

This appears to be implemented correctly as readonly in the Go SDK [here](https://github.com/Azure/azure-sdk-for-go/blob/master/services/preview/securityinsight/mgmt/2019-01-01-preview/securityinsight/models.go#L17812) - From this im guessing this must be a backend issue. severity and displayName should both be readonly although are required. See below of a succesful API Request:
![image](https://user-images.githubusercontent.com/29356754/116809047-23ab2580-ab34-11eb-96e6-7c8411fff0fe.png)

https://github.com/Azure/azure-rest-api-specs/blob/dceaa75fe47854ad7b0fcc0c7cf38677b4bb181f/specification/securityinsights/resource-manager/Microsoft.SecurityInsights/preview/2019-01-01-preview/SecurityInsights.json#L9021

Contributor guide

Open the contributing guide

Research direction

Start at SecurityInsights.json around line 9021 and compare the ThreatIntelligenceAlertRuleProperties definition with the linked Go SDK models.go implementation. Verify whether severity and displayName are marked read-only while still required, and determine whether the mismatch belongs in the specification or the backend. Done means the API contract and generated behavior consistently reflect the observed request requirements.

Written by the indexing model from the issue text.

Assessment

Tech stack
openapi
Domain
api
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Clearly specified
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.