azure 如何解决使用Terraform创建Sentinel Alert Rule Scheduled失败的问题

hgb9j2n6 于 2023-05-01 发布在其他

关注(0)|答案(1)|浏览(166)

我正在尝试使用Sentinel Alert Automation Rule和Sentinel Alert Rule Scheduled部署Microsoft Sentinel解决方案。我使用一个服务主体来分配Microsoft Sentinel Automation Contributor，这样它就可以创建自动化规则，其中有脚本要运行（代码中还没有包含这样的自动化规则）。然而，当我运行terraform apply时，它无法创建警报规则计划，给我一个关于工作簿找不到的错误。我没有用他们提供的ID创建工作簿。有人能解释一下为什么会发生这种情况，以及如何解决它？

编码：

terraform {}

provider "azurerm" {
  features {}
}

resource "azurerm_resource_group" "example" {
  name     = "rg-sentinel-alert-rule-test"
  location = "eastus2"
}

resource "azurerm_log_analytics_workspace" "example" {
  name                = "example-workspace"
  location            = azurerm_resource_group.example.location
  resource_group_name = azurerm_resource_group.example.name
  sku                 = "PerGB2018"

  depends_on = [azurerm_resource_group.example]
}

resource "azurerm_sentinel_log_analytics_workspace_onboarding" "example" {
  workspace_id = azurerm_log_analytics_workspace.example.id

  depends_on = [azurerm_log_analytics_workspace.example]
}

data "azuread_service_principal" "security_insight" {
  display_name = "Azure Security Insights"

  depends_on = [azurerm_sentinel_log_analytics_workspace_onboarding.example]
}

resource "azurerm_role_assignment" "sentinel_automation_contributor" {
  scope                = azurerm_resource_group.example.id
  role_definition_name = "Microsoft Sentinel Automation Contributor"
  principal_id         = data.azuread_service_principal.security_insight.object_id

  depends_on = [azurerm_sentinel_log_analytics_workspace_onboarding.example]
}

resource "azurerm_sentinel_alert_rule_scheduled" "example" {
  name                       = "example"
  log_analytics_workspace_id = azurerm_sentinel_log_analytics_workspace_onboarding.example.workspace_id
  display_name               = "example"
  severity                   = "High"
  query                      = <<QUERY
AzureActivity |
  where OperationName == "Create or Update Virtual Machine" or OperationName =="Create Deployment" |
  where ActivityStatus == "Succeeded" |
  make-series dcount(ResourceId) default=0 on EventSubmissionTimestamp in range(ago(7d), now(), 1d) by Caller
QUERY

  depends_on = [azurerm_sentinel_log_analytics_workspace_onboarding.example]
}

resource "azurerm_sentinel_automation_rule" "example" {
  name                       = "56094f72-ac3f-40e7-a0c0-47bd95f70336"
  log_analytics_workspace_id = azurerm_sentinel_log_analytics_workspace_onboarding.example.workspace_id
  display_name               = "automation_rule1"
  order                      = 1
  action_incident {
    order  = 1
    status = "Active"
  }

  depends_on = [azurerm_role_assignment.sentinel_automation_contributor]
}

错误：

Error: creating Sentinel Alert Rule Scheduled "Alert Rule (Subscription: \"{my-subscription-id}\"\n
Resource Group Name: \"rg-sentinel-alert-rule-test\"\n
Workspace Name: \"example-workspace\"\nRule: \"example\")":
alertrules.AlertRulesClient#AlertRulesCreateOrUpdate: Failure responding to request:
StatusCode=400 -- Original Error: autorest/azure: Service returned an error. Status=400
Code="BadRequest" Message="Failed to run the analytics rule query. Log Analytics
workspace 'b819562b-650e-4277-9035-c89a1f6d64c5' could not be found."
│ 
│   with azurerm_sentinel_alert_rule_scheduled.example,
│   on main.tf line 41, in resource "azurerm_sentinel_alert_rule_scheduled" "example":
│   41: resource "azurerm_sentinel_alert_rule_scheduled" "example" {
│ 
╵

Azure

来源：https://stackoverflow.com/questions/76079150/how-to-resolve-the-failing-of-creating-sentinel-alert-rule-scheduled-using-terra

1条答案

按热度按时间

koaltpgm1#

我使用的是Terraform Provider版本3。40和
我已经检查了log_analytics_workspace_id = azurerm_sentinel_log_analytics_workspace_onboarding.example.workspace_id，它给出了错误。我使用的是Terraform版本3。四十：
验证码：

resource "azurerm_sentinel_alert_rule_scheduled" "example" {
name = "examplekaalertrule"
log_analytics_workspace_id =  azurerm_sentinel_log_analytics_workspace_onboarding.example.workspace_id  
display_name = "examplesentielrule"
severity = "High"
query = <<QUERY
AzureActivity |
where OperationName == "Create or Update Virtual Machine" or OperationName =="Create Deployment" |
where ActivityStatus == "Succeeded" |
make-series dcount(ResourceId) default=0 on EventSubmissionTimestamp in range(ago(7d), now(), 1d) by Caller
QUERY

depends_on = [
  azurerm_sentinel_log_analytics_workspace_onboarding.example
]
}

检查以下代码，为我工作。
验证码：

resource "azurerm_log_analytics_workspace" "rgcore-management-la" {
  name                = "la-example-utv-weu"
 location                    = data.azurerm_resource_group.example.location
  resource_group_name         = data.azurerm_resource_group.example.name
  sku                 = "PerGB2018"
  retention_in_days   = 90
}

resource "azurerm_log_analytics_solution" "example" {
  solution_name         = "SecurityInsights"
 location                    = data.azurerm_resource_group.example.location
  resource_group_name         = data.azurerm_resource_group.example.name
  workspace_resource_id = azurerm_log_analytics_workspace.rgcore-management-la.id
  workspace_name        = azurerm_log_analytics_workspace.rgcore-management-la.name
  plan {
    publisher = "Microsoft"
    product   = "OMSGallery/SecurityInsights"
  }
  depends_on = [azurerm_log_analytics_workspace.rgcore-management-la]

}


resource "azurerm_sentinel_log_analytics_workspace_onboarding" "example" {
  resource_group_name          = data.azurerm_resource_group.example.name
  workspace_name               = azurerm_log_analytics_workspace.rgcore-management-la.name
  customer_managed_key_enabled = false

}



resource "azurerm_sentinel_alert_rule_scheduled" "example" {
name = "examplekaalertrule"
log_analytics_workspace_id = azurerm_log_analytics_solution.example.workspace_resource_id 
display_name = "examplesentielrule"
severity = "High"
query = <<QUERY
AzureActivity |
where OperationName == "Create or Update Virtual Machine" or OperationName =="Create Deployment" |
where ActivityStatus == "Succeeded" |
make-series dcount(ResourceId) default=0 on EventSubmissionTimestamp in range(ago(7d), now(), 1d) by Caller
QUERY

depends_on = [
  azurerm_sentinel_log_analytics_workspace_onboarding.example
]
}

Terraform Provider版本35.0和az cli版本2。30，即使下面的代码是由你提供的代码工作.

resource "azurerm_log_analytics_workspace" "management-la" {
  name                = "example-weu"
 location                    = data.azurerm_resource_group.example.location
  resource_group_name         = data.azurerm_resource_group.example.name
  sku                 = "PerGB2018"
  retention_in_days   = 90
}


resource "azurerm_sentinel_log_analytics_workspace_onboarding" "example" {
  workspace_id = azurerm_log_analytics_workspace.management-la.id
}

resource "azurerm_sentinel_alert_rule_scheduled" "example" {
  name                       = "edfgxample"
  log_analytics_workspace_id = azurerm_sentinel_log_analytics_workspace_onboarding.example.workspace_id
  display_name               = "exghjample"
  severity                   = "High"
  query                      = <<QUERY
AzureActivity |
  where OperationName == "Create or Update Virtual Machine" or OperationName =="Create Deployment" |
  where ActivityStatus == "Succeeded" |
  make-series dcount(ResourceId) default=0 on EventSubmissionTimestamp in range(ago(7d), now(), 1d) by Caller
QUERY
}

检查您是否具有访问Log Analytics工作区的必要权限。用于运行代码的Azure AD用户或服务主体在日志分析工作区中具有“参与者”角色。
还要确保Log Analytics工作区是否已删除或销毁。

赞(0）回复(0）举报 2023-05-01

我来回答

azure 如何解决使用Terraform创建Sentinel Alert Rule Scheduled失败的问题

编码：

错误：

1条答案

相关问题

热门标签

最新问答