Azure / Azure/azure-rest-api-specs

Sentinel (securityinsights) API throws "OData query syntax error"

Open
#26,569 1 comment 0 reactions 0 assignees View on GitHub
SecurityInsights Service Attention
Dominant language
TypeSpec
Stars
3.1k
Forks
5.9k
Avg merge
3d 2h
Merged PRs (30d)
424

Description

Hello, I am trying to use Sentinel REST API (api-version=2023-02-01) for incidents with filters against `labels`. I have ran into numerous problems, which seems could be considers as bugs:

1. Two conditions against two different `labels` values throw Bad Request error (this is most important issue for me)
`$filter=(properties/labels/any(label: label/labelName eq 'test') or properties/severity eq 'High') and (properties/labels/any(label: label/labelName eq 'test2') or properties/status eq 'Active')`
```
{
"error": {
"code": "BadRequest",
"message": "OData query syntax error"
}
}
```

2. $filter value "wrong" conditions order forces api error response (HTTP 400 Bad Request)
`$filter=properties/severity eq 'High' and properties/labels/any(label: label/labelName eq 'test')` <--- FAILS
luckily I found a work-around - I have to change order of conditions(!)
`$filter=properties/labels/any(label: label/labelName eq 'test') and properties/severity eq 'High'` <--- is OK

3. `all` operator does not work, throws the Bad Request error
`$filter=properties/labels/all(label: label/labelName eq 'test')` or `$filter=properties/labels/all(label: label/labelName ne 'test')`

I followed this UI to build a query and/or grab a token, and then I ported it to Postman for better convenience:
https://learn.microsoft.com/en-us/rest/api/securityinsights/incidents/list?view=rest-securityinsights-2023-02-01&tabs=HTTP&tryIt=true

I tried to read on Azure Cognitive Search (https://learn.microsoft.com/en-us/azure/search/), and I didn't find much success to understand if I am doing something wrong.

Contributor guide

Open the contributing guide

Research direction

Start with the Sentinel incidents list endpoint linked in the issue and reproduce the three `$filter` cases using API version 2023-02-01. Compare the failing and working query forms, then determine whether the behavior is represented in this repository or needs service-owner clarification; done means a confirmed diagnosis with the affected API behavior documented.

Written by the indexing model from the issue text.

Assessment

Tech stack
azure
Domain
api, security
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
30/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.