Azure / Azure/azure-rest-api-specs

[BUG] Terraform/Bicep Sentinel Connectors: Microsoft.SecurityInsights/contentProductPackages@2025-03-01

Open
#33,423 1 comment 1 reaction 0 assignees View on GitHub
bug customer-reported question SecurityInsights Service Attention
Dominant language
TypeSpec
Stars
3.1k
Forks
5.9k
Avg merge
2d 22h
Merged PRs (30d)
444

Description

### API Spec link

https://learn.microsoft.com/en-us/azure/templates/microsoft.securityinsights/contentpackages?pivots=deployment-language-terraform

### API Spec version

2025-03-01

### Describe the bug

**Describe the bug**
A clear and concise description of what the bug is.

I am trying to deploy Sentinel Connector using Terraform/Bicep, however seems that output data from API is trunkated.

### Expected behavior

1. Expected fields:
```
id
title
publisher
descriptionMarkdown
logo
lastDataReceivedInfoBalloon
graphQueries
sampleQueries
connectivityCriterias
dataTypes
availability
permissions
instructionSteps
metadata
```
2. Response fields:
```
connectorUiConfig:
{
connectivityCriterias
dataTypes
descriptionMarkdown
graphQueries
id
publisher
title
}
```

### Actual behavior

1. Output contains multiple contentPackages including:
https://gist.github.com/bisskar/7a720b23c42bca01869627c888b8e323
2. Data is truncated for DataConnectors

### Reproduction Steps

**To Reproduce**
Steps to reproduce the behavior:
1. Create log analytics workspace + onboard Azure Sentinel
2. Example: Azure Activity
3. User Terraform data source
```
data "azapi_resource" "get_defined_contentProductPackages" {
type = "Microsoft.SecurityInsights/contentProductPackages@2025-03-01"
name = "azuresentinel.azure-sentinel-solution-azureactivit-sl-x6rxfrmsjp3pw"
parent_id = "/subscriptions/${subscriptionID}/resourceGroups/${resourceGroup}/providers/microsoft.operationalinsights/workspaces/${logAnalyticsName}"
response_export_values = ["properties"]
}`
```

**Additional context**
Missing resource properties prevents deploying data connector, to be more specific "Microsoft.OperationalInsights/workspaces/providers/contentTemplates" using Bicep/Terraform dynamically,
While deploying resource using terraform,deployment is successful, connectors are not visible in Sentinel.
Attached TF code - the same approach works properly for Analytics, Workbooks and Playbooks.
Connectors are causing issues.

Same API response using different API versions.

Example terraform config:
https://gist.github.com/bisskar/fe2959085ed11159ada6c6b818495c2e

Please ignore hardcoded values, subscription does no longer exist.

### Environment

_No response_

Contributor guide

Open the contributing guide

Research direction

Start with the linked Microsoft.SecurityInsights/contentProductPackages@2025-03-01 API specification and reproduce the response using the shown Terraform azapi_resource data source. Compare the connectorUiConfig fields with the expected fields and the contentTemplates deployment behavior. Done means the response exposes the required connector properties and the deployed connectors appear in Sentinel; no repository file or test is named.

Written by the indexing model from the issue text.

Assessment

Tech stack
azure, terraform
Domain
api, cloud
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.