Azure / Azure/terraform-provider-azapi

Terraform/Bicep Sentinel Connectors: Microsoft.SecurityInsights/contentProductPackages@2025-03-01

Open
#822 5 comments 0 reactions 0 assignees View on GitHub
triaged
Dominant language
Go
Stars
244
Forks
97
Avg merge
5d 9h
Merged PRs (30d)
9

Description

**Describe the bug**
A clear and concise description of what the bug is.

I am trying to deploy Sentinel Connector using Terraform/Bicep, however seems that output data from API is trunkated.

**To Reproduce**
Steps to reproduce the behavior:
1. Create log analytics workspace + onboard Azure Sentinel
2. Example: Azure Activity
3. User Terraform data source
```
data "azapi_resource" "get_defined_contentProductPackages" {
type = "Microsoft.SecurityInsights/contentProductPackages@2025-03-01"
name = "azuresentinel.azure-sentinel-solution-azureactivit-sl-x6rxfrmsjp3pw"
parent_id = "/subscriptions/${subscriptionID}/resourceGroups/${resourceGroup}/providers/microsoft.operationalinsights/workspaces/${logAnalyticsName}"
response_export_values = ["properties"]
}
```
4. Output contains multiple contentPackages including:
https://gist.github.com/bisskar/7a720b23c42bca01869627c888b8e323
5. Data is truncated.
6. Expected fields:
```
id
title
publisher
descriptionMarkdown
logo
lastDataReceivedInfoBalloon
graphQueries
sampleQueries
connectivityCriterias
dataTypes
availability
permissions
instructionSteps
metadata
```
7. Response fields:
```
connectorUiConfig:
{
connectivityCriterias
dataTypes
descriptionMarkdown
graphQueries
id
publisher
title
}
```

**Expected behavior**
How output should look like:
https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Azure%20Activity/Data%20Connectors/AzureActivity.json

**Additional context**
Missing resource properties prevents deploying data connector, to be more specific "Microsoft.OperationalInsights/workspaces/providers/contentTemplates" using Bicep/Terraform dynamically,
While deploying resource using terraform,deployment is successful, connectors are not visible in Sentinel.
Attached TF code - the same approach works properly for Analytics, Workbooks and Playbooks.
Connectors are causing issues.

Same API response using different API versions.

Example terraform config:
https://gist.github.com/bisskar/fe2959085ed11159ada6c6b818495c2e

Please ignore hardcoded values, subscription does no longer exist.

Contributor guide

Open the contributing guide

Research direction

Start with the attached Terraform configuration and the azapi_resource data source using Microsoft.SecurityInsights/contentProductPackages@2025-03-01; compare its response_export_values output with the linked Azure Activity JSON and the listed expected fields. Done means the connector properties are returned without truncation and the dynamically deployed connector becomes visible in Sentinel.

Written by the indexing model from the issue text.

Assessment

Tech stack
azure, go, terraform
Domain
api, cloud, infrastructure
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
38/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.