microsoftgraph / microsoftgraph/msgraph-sdk-powershell

Get-MgBetaSecurityAuditLogQueryRecord

Open
#2,677 10 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Service issue Status: Under Investigation
Dominant language
C#
Stars
898
Forks
230
Avg merge
2d 5h
Merged PRs (30d)
31

Description

It seems a string formatting error since it's missing the } that close the object

Following the script that I use:

$ClientSecretCredential = New-Object -TypeName System.Management.Automation.PSCredential -ArgumentList $AppID, (ConvertTo-SecureString -String $AppSecret -AsPlainText -Force)
Connect-MgGraph -ClientSecretCredential $ClientSecretCredential -TenantId $TID -ErrorAction Stop

New-MgBetaSecurityAuditLogQuery -FilterStartDateTime "2024-03-25 00:00" -FilterEndDateTime "2024-03-29 23:59" -DisplayName "activities"

PS C:\Users\Skype4bsched> Get-MgBetaSecurityAuditLogQueryRecord -AuditLogQueryId QueryID -All -Debug
DEBUG: [CmdletBeginProcessing]: - Get-MgBetaSecurityAuditLogQueryRecord begin processing with parameterSet 'List'.
DEBUG: [Authentication]: - AuthType: 'AppOnly', TokenCredentialType: 'ClientSecret', ContextScope: 'Process', AppName: 'GOSP-UCC-Reporting'.
DEBUG: [Authentication]: - Scopes: [...AuditLogsQuery.Read.All, AuditLog.Read.All, ...].
DEBUG: ============================ HTTP REQUEST ============================

HTTP Method:
GET

Absolute Uri:
https://graph.microsoft.com/beta/security/auditLog/queries/*QueryID*/records

Headers:
FeatureFlag : 00000043
Cache-Control : no-store, no-cache
User-Agent : Mozilla/5.0,(Windows NT 10.0; Microsoft Windows 10.0.17763; it-IT),PowerShell/5.1.17763.5696
Accept-Encoding : gzip
SdkVersion : graph-powershell-beta/2.17.0
client-request-id : ClientID

Body:

DEBUG: ============================ HTTP RESPONSE ============================

Status Code:
OK

Headers:
Transfer-Encoding : chunked
Vary : Accept-Encoding
Strict-Transport-Security : max-age=31536000
request-id : 49dd6246-10aa-4a4f-ba47-e2820c958696
client-request-id : ClientID
x-ms-ags-diagnostic : {"ServerInfo":{"DataCenter":"Italy North","Slice":"E","Ring":"3","ScaleUnit":"001","RoleInstance":"MI2PEPF000002CD"}}
OData-Version : 4.0
Cache-Control : no-cache
Date : Fri, 12 Apr 2024 08:34:30 GMT

Body:
{
"@odata.context": "https://graph.microsoft.com/beta/$metadata#security/auditLog/queries('*QueryID*')/records",
"@odata.count": 150,
"@odata.nextLink": "https://graph.microsoft.com/beta/security/auditLog/queries/*QueryID*/records?$skiptoken=1!4!MA--%2f1!48!MDAwOGE5ZTQtYTgzOC00NjcxLTI3OTgtMDhkYzRkOGNiYTY1",
"value": [...]
}

DEBUG: ============================ HTTP REQUEST ============================

HTTP Method:
GET

Absolute Uri:
https://graph.microsoft.com/beta/security/auditLog/queries/*QueryID*/records?$skiptoken=1!4!MA--%2f1!48!MDAwOGE5ZTQtYTgzOC00NjcxLTI3OTgtMDhkYzRkOGNiYTY1

Headers:
FeatureFlag : 00000043
Cache-Control : no-store, no-cache
Accept-Encoding : gzip
SdkVersion : graph-powershell-beta/2.17.0,
client-request-id : 25806d5f-7bdd-4a3d-ac0b-c0496b2cd5e5
User-Agent : Mozilla/5.0,(Windows NT 10.0; Microsoft Windows 10.0.17763; it-IT),PowerShell/5.1.17763.5696

Body:

DEBUG: ============================ HTTP RESPONSE ============================

Status Code:
OK

Headers:
Transfer-Encoding : chunked
Vary : Accept-Encoding
Strict-Transport-Security : max-age=31536000
request-id : 95a34a58-4332-493c-820d-0692c61ce6b6
client-request-id : 25806d5f-7bdd-4a3d-ac0b-c0496b2cd5e5
x-ms-ags-diagnostic : {"ServerInfo":{"DataCenter":"Italy North","Slice":"E","Ring":"3","ScaleUnit":"001","RoleInstance":"MI2PEPF000002CD"}}
OData-Version : 4.0
Cache-Control : no-cache
Date : Fri, 12 Apr 2024 08:34:32 GMT

Body:
{
"@odata.context": "https://graph.microsoft.com/beta/$metadata#security/auditLog/queries('*QueryID*')/records",
"@odata.count": 150,
"@odata.nextLink": "https://graph.microsoft.com/beta/security/auditLog/queries/*QueryID*/records?$skiptoken=1!4!MA--%2f1!48!MDAxMGYwNDAtYmM5Mi00YzZmLTZlZTYtMDhkYzRjYTE3ODA2",
"value": [...]
}

Id AdministrativeUnits AuditLogRecordType ClientIP CreatedDateTime ObjectId

DEBUG: ============================ HTTP REQUEST ============================

HTTP Method:
GET

Absolute Uri:
https://graph.microsoft.com/beta/security/auditLog/queries/*QueryID*/records?$skiptoken=1!4!MA--%2f1!48!MDAxMGYwNDAtYmM5Mi00YzZmLTZlZTYtMDhkYzRjYTE3ODA2

Headers:
FeatureFlag : 00000043
Cache-Control : no-store, no-cache
Accept-Encoding : gzip
SdkVersion : graph-powershell-beta/2.17.0,
client-request-id : 0ed353da-584c-4760-b8be-d5aa082b1c47
User-Agent : Mozilla/5.0,(Windows NT 10.0; Microsoft Windows 10.0.17763; it-IT),PowerShell/5.1.17763.5696

Body:

DEBUG: ============================ HTTP RESPONSE ============================

Status Code:
OK

Headers:
Transfer-Encoding : chunked
Vary : Accept-Encoding
Strict-Transport-Security : max-age=31536000
request-id : edb7916f-f77e-451b-b610-bf02b4851563
client-request-id : 0ed353da-584c-4760-b8be-d5aa082b1c47
x-ms-ags-diagnostic : {"ServerInfo":{"DataCenter":"Italy North","Slice":"E","Ring":"3","ScaleUnit":"001","RoleInstance":"MI2PEPF000002CD"}}
OData-Version : 4.0
Cache-Control : no-cache
Date : Fri, 12 Apr 2024 08:34:34 GMT

Body:
{
"@odata.context": "https://graph.microsoft.com/beta/$metadata#security/auditLog/queries('*QueryID*')/records",
"@odata.count": 150,
"@odata.nextLink": "https://graph.microsoft.com/beta/security/auditLog/queries/*QueryID*/records?$skiptoken=1!4!MA--%2f1!48!MDAxOTcwNzEtMWMxYy00NWNkLWQzZjktMDhkYzRlMzkyMGRi",
"value": [...]
}

DEBUG: ============================ HTTP REQUEST ============================

HTTP Method:
GET

Absolute Uri:
https://graph.microsoft.com/beta/security/auditLog/queries/*QueryID*/records?$skiptoken=1!4!MA--%2f1!48!MDAxOTcwNzEtMWMxYy00NWNkLWQzZjktMDhkYzRlMzkyMGRi

Headers:
FeatureFlag : 00000043
Cache-Control : no-store, no-cache
Accept-Encoding : gzip
SdkVersion : graph-powershell-beta/2.17.0,
client-request-id : 5e3b79cc-e9de-4de9-8676-0f7ddca8f5e2
User-Agent : Mozilla/5.0,(Windows NT 10.0; Microsoft Windows 10.0.17763; it-IT),PowerShell/5.1.17763.5696

Body:

DEBUG: ============================ HTTP RESPONSE ============================

Status Code:
OK

Headers:
Transfer-Encoding : chunked
Vary : Accept-Encoding
Strict-Transport-Security : max-age=31536000
request-id : 8ba8f3e4-9459-4777-b506-5d1152fceeca
client-request-id : 5e3b79cc-e9de-4de9-8676-0f7ddca8f5e2
x-ms-ags-diagnostic : {"ServerInfo":{"DataCenter":"Italy North","Slice":"E","Ring":"3","ScaleUnit":"001","RoleInstance":"MI2PEPF000002CD"}}
OData-Version : 4.0
Cache-Control : no-cache
Date : Fri, 12 Apr 2024 08:34:35 GMT

Body:
{
"@odata.context": "https://graph.microsoft.com/beta/$metadata#security/auditLog/queries('*QueryID*')/records",
"@odata.count": 150,
"@odata.nextLink": "https://graph.microsoft.com/beta/security/auditLog/queries/*QueryID*/records?$skiptoken=1!4!MA--%2f1!48!MDAyMWRkNzgtN2ZiYi00ZWI2LWYxZTYtMDhkYzRlNTBiZjVh",
"value": [...]
}

DEBUG: ============================ HTTP REQUEST ============================

HTTP Method:
GET

Absolute Uri:
https://graph.microsoft.com/beta/security/auditLog/queries/*QueryID*/records?$skiptoken=1!4!MA--%2f1!48!MDAyMWRkNzgtN2ZiYi00ZWI2LWYxZTYtMDhkYzRlNTBiZjVh

Headers:
FeatureFlag : 00000043
Cache-Control : no-store, no-cache
Accept-Encoding : gzip
SdkVersion : graph-powershell-beta/2.17.0,
client-request-id : 917fecde-2343-4130-add3-db179e2392fd
User-Agent : Mozilla/5.0,(Windows NT 10.0; Microsoft Windows 10.0.17763; it-IT),PowerShell/5.1.17763.5696

Body:

DEBUG: ============================ HTTP RESPONSE ============================

Status Code:
OK

Headers:
Transfer-Encoding : chunked
Vary : Accept-Encoding
Strict-Transport-Security : max-age=31536000
request-id : a91c3698-df25-4b46-a0e9-2e3aa996b628
client-request-id : 917fecde-2343-4130-add3-db179e2392fd
x-ms-ags-diagnostic : {"ServerInfo":{"DataCenter":"Italy North","Slice":"E","Ring":"3","ScaleUnit":"001","RoleInstance":"MI2PEPF000002CD"}}
OData-Version : 4.0
Cache-Control : no-cache
Date : Fri, 12 Apr 2024 08:34:37 GMT

Body:
{...,
{"id":"002aae90-f402-c84e-6212-2a14a29e4f36",
"createdDateTime":"2024-03-27T13:04:31Z",
"auditLogRecordType":"Yammer",
"operation":"FileVisited",
"organizationId":"",
"userType":"Regular",
"userId":"",
"service":"Yammer",
"objectId":".jpg",
"userPrincipalName":"",
"clientIp":null,
"administrativeUnits":[""]
{"error":
{"code":"UnknownError",
"message":"Unexpected Jsontoken. Check response for property value[141].auditData.ActorYammerUserId",
"innerError":{"date":"2024-04-12T08:44:40",
"request-id":"e6e1bd2f-3476-453d-903f-945dda906c28",
"client-request-id":"3d8b7b60-2d19-416e-9e0e-0d973fea9101"
}
}
}

}

DEBUG: [CmdletException]: Received exception with message 'ParserException - Expected String while reading Expected field name). Was LeftBrace: {. : at Microsoft.Graph.Beta.PowerShell.Runtime.Json.TokenReader.Ensure(TokenKind kind, String readerName)
at Microsoft.Graph.Beta.PowerShell.Runtime.Json.JsonParser.ReadObject()
at Microsoft.Graph.Beta.PowerShell.Runtime.Json.JsonParser.ReadArray()
at Microsoft.Graph.Beta.PowerShell.Runtime.Json.JsonParser.ReadFieldValue()
at Microsoft.Graph.Beta.PowerShell.Runtime.Json.JsonParser.ReadField()
at Microsoft.Graph.Beta.PowerShell.Runtime.Json.JsonParser.ReadObject()
at Microsoft.Graph.Beta.PowerShell.Runtime.Json.JsonParser.ReadNode()
at Microsoft.Graph.Beta.PowerShell.Runtime.Json.JsonNode.Parse(SourceReader sourceReader)
at Microsoft.Graph.Beta.PowerShell.Security.<>c.<SecurityAuditLogQueryListRecord_Call>b__375_0(Task1 body) at System.Threading.Tasks.ContinuationResultTaskFromResultTask2.InnerInvoke()
at System.Threading.Tasks.Task.Execute()
--- End of stack trace from previous location where exception was thrown ---
at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()
at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)
at Microsoft.Graph.Beta.PowerShell.Cmdlets.GetMgBetaSecurityAuditLogQueryRecord_List.d__94.MoveNext()
--- End of stack trace from previous location where exception was thrown ---
at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()
at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)
at Microsoft.Graph.Beta.PowerShell.Security.<SecurityAuditLogQueryListRecord_Call>d__375.MoveNext()
--- End of stack trace from previous location where exception was thrown ---
at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()
at Microsoft.Graph.Beta.PowerShell.Security.<SecurityAuditLogQueryListRecord_Call>d__375.MoveNext()
--- End of stack trace from previous location where exception was thrown ---
at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()
at Microsoft.Graph.Beta.PowerShell.Cmdlets.GetMgBetaSecurityAuditLogQueryRecord_List.d__94.MoveNext()
--- End of stack trace from previous location where exception was thrown ---
at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()
at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)
at Microsoft.Graph.Beta.PowerShell.Security.<SecurityAuditLogQueryListRecord_Call>d__375.MoveNext()
--- End of stack trace from previous location where exception was thrown ---
at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()
at Microsoft.Graph.Beta.PowerShell.Security.<SecurityAuditLogQueryListRecord_Call>d__375.MoveNext()
--- End of stack trace from previous location where exception was thrown ---
at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()
at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)
at Microsoft.Graph.Beta.PowerShell.Security.d__373.MoveNext()
--- End of stack trace from previous location where exception was thrown ---
at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()
at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)
at Microsoft.Graph.Beta.PowerShell.Cmdlets.GetMgBetaSecurityAuditLogQueryRecord_List.d__92.MoveNext()'
Get-MgBetaSecurityAuditLogQueryRecord : Expected String while reading Expected field name). Was LeftBrace: {.
At line:1 char:1

  • Get-MgBetaSecurityAuditLogQueryRecord -AuditLogQueryId ****- ...
  •   + CategoryInfo          : NotSpecified: (:) [Get-MgBetaSecur...ueryRecord_List], ParserException
  + FullyQualifiedErrorId : Microsoft.Graph.Beta.PowerShell.Cmdlets.GetMgBetaSecurityAuditLogQueryRecord_List

DEBUG: [CmdletEndProcessing]: - Get-MgBetaSecurityAuditLogQueryRecord end processing.

Module Version
Get-Module Microsoft.Graph*

ModuleType Version Name ExportedCommands

Script 2.17.0 Microsoft.Graph.Authentication {Add-MgEnvironment, Connect-MgGraph, Disconnect-MgGraph, Get-MgContext...}
Script 2.17.0 Microsoft.Graph.Beta.Security {Add-MgBetaSecurityCaseEdiscoveryCaseCustodianHold, Add-MgBetaSecurityCaseEdiscoveryCaseNoncustodialDataSourceHold, Add-MgBetaSecurityCaseEdiscoveryCaseReviewSetQueryTag, Add-MgBetaSecurityCaseEdi...
Script 2.17.0 Microsoft.Graph.Users {Get-MgUser, Get-MgUserCount, Get-MgUserCreatedObject, Get-MgUserCreatedObjectAsServicePrincipal...}

Environment Data
$PSVersionTable

Name Value

PSVersion 5.1.17763.5696
PSEdition Desktop
PSCompatibleVersions {1.0, 2.0, 3.0, 4.0...}
BuildVersion 10.0.17763.5696
CLRVersion 4.0.30319.42000
WSManStackVersion 3.0
PSRemotingProtocolVersion 2.3
SerializationVersion 1.1.0.1

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start by reproducing Get-MgBetaSecurityAuditLogQueryRecord with the captured audit-log query and inspect the response around value[141]. Then trace the SecurityAuditLogQueryListRecord_Call stack into the JSON parser to determine whether the malformed object comes from the service response or parsing; done means the failure is corrected or clearly isolated with regression coverage.

Written by the indexing model from the issue text.

Assessment

Tech stack
csharp, json, powershell
Domain
api, backend, cli
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.