Azure / Azure/azure-rest-api-specs
Sentinel (securityinsights) API throws "OData query syntax error"
- Dominant language
- TypeSpec
- Stars
- 3.1k
- Forks
- 5.9k
- Avg merge
- 3d 2h
- Merged PRs (30d)
- 424
Description
Hello, I am trying to use Sentinel REST API (api-version=2023-02-01) for incidents with filters against `labels`. I have ran into numerous problems, which seems could be considers as bugs:
1. Two conditions against two different `labels` values throw Bad Request error (this is most important issue for me)
`$filter=(properties/labels/any(label: label/labelName eq 'test') or properties/severity eq 'High') and (properties/labels/any(label: label/labelName eq 'test2') or properties/status eq 'Active')`
```
{
"error": {
"code": "BadRequest",
"message": "OData query syntax error"
}
}
```
2. $filter value "wrong" conditions order forces api error response (HTTP 400 Bad Request)
`$filter=properties/severity eq 'High' and properties/labels/any(label: label/labelName eq 'test')` <--- FAILS
luckily I found a work-around - I have to change order of conditions(!)
`$filter=properties/labels/any(label: label/labelName eq 'test') and properties/severity eq 'High'` <--- is OK
3. `all` operator does not work, throws the Bad Request error
`$filter=properties/labels/all(label: label/labelName eq 'test')` or `$filter=properties/labels/all(label: label/labelName ne 'test')`
I followed this UI to build a query and/or grab a token, and then I ported it to Postman for better convenience:
https://learn.microsoft.com/en-us/rest/api/securityinsights/incidents/list?view=rest-securityinsights-2023-02-01&tabs=HTTP&tryIt=true
I tried to read on Azure Cognitive Search (https://learn.microsoft.com/en-us/azure/search/), and I didn't find much success to understand if I am doing something wrong.
Contributor guide
Research direction
Start with the Sentinel incidents list endpoint linked in the issue and reproduce the three `$filter` cases using API version 2023-02-01. Compare the failing and working query forms, then determine whether the behavior is represented in this repository or needs service-owner clarification; done means a confirmed diagnosis with the affected API behavior documented.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- azure
- Domain
- api, security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 30/100