Azure / Azure/azure-rest-api-specs

[BUG] Defender for Cloud Alerts List endpoint returning different responses

Open
#38,880 0 comments 0 reactions 0 assignees View on GitHub
bug customer-reported Mgmt question Service Attention
Dominant language
TypeSpec
Stars
3.1k
Forks
5.9k
Avg merge
2d 22h
Merged PRs (30d)
444

Description

### API Spec link

https://learn.microsoft.com/en-us/rest/api/defenderforcloud/alerts/list?view=rest-defenderforcloud-2022-01-01&tabs=HTTP

### API Spec version

2022-01-01

### Describe the bug

The endpoint is sending back responses with differing information and formats for the same request sent.

### Expected behavior

Consistency in the response information and format. Existing behaviour before this had the response include the severity and isIncident fields and used camelCase for the nested objects.

### Actual behavior

One type of response includes the alert severity and isIncident fields and camelCase formatted keys within the nested objects (eg. extendedProperties, resourceIdentifiers), the other type does not include the severity and isIncident fields and uses PascalCase for the keys of the nested objects.

Eg. For the same alert:

| Response 1 | Response 2 |
|------|-------|
|Image|Image|
|Image|Image|
|Image|Image|

Additionally, in resourceIdentifiers and entities, in Response 1, the '$id" field is a string containing a region eg. "centralus_1" whereas in Response 2, the "$id" field is a number that increases throughout the response.

### Reproduction Steps

Make multiple requests to the api, the response should change at random.

### Environment

_No response_

Contributor guide

Open the contributing guide

Research direction

Start with the Defender for Cloud Alerts List endpoint in the linked API specification, using version 2022-01-01, and reproduce the issue with multiple requests. Compare the response fields, nested-object casing, and resourceIdentifiers/entities $id values against the documented format. Done means repeated requests return a consistent response containing the expected severity and isIncident fields and stable casing and $id representation.

Written by the indexing model from the issue text.

Assessment

Tech stack
azure, openapi
Domain
api, cloud
Issue type
Bug
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.