Discussions now available!

[briandelmsft]

We've enabled the ability to create discussions in the GitHub repo to discuss any issues, share feedback or ask any questions about the project.

We will monitor this regularly so please don't hesitate to get the conversation started by creating a new discussion.

[Castelias]

Hey, we are currently using your STAT v1 solution and I've noticed that MCAS module failes with error 502, 99% of a time it happens when there are accounts associated with incident. Have you ever encountered this?

[briandelmsft]

Yes, unfortunately we have. The MDCA Investigation Priority score used by this module is being retired by Microsoft, as announced in the M365 Message Center MC889532. The module will fail as a result and should be removed from your analysis. The score was the only thing the module was using so there are no other insights lost by removing the module.

This removal by Microsoft has been happening over the last 2-3 months or so which could make it somewhat sporadic but at this point I would expect it to fail pretty consistently. The module will only attempt to call the deprecated API when there are account entities so it should not fail if there's no accounts, but it doesn't really do anything in that scenario.

In STAT v2 this module is being removed from the next build, but is still in the current build.

[Castelias]

Wow, Thanks for such a quick and comprehensive reply.

[ga8806123]

Hi,

Currently The STAT playbook does pull user information from entra but it does not have company information added in the comment section. Where do I edit the playbook so that the playbook knows to pull that piece of information.

Many thanks

[briandelmsft]

hi @ga8806123 at present the company attribute is not retrieved by STAT and the comment is not configurable. So you could get it in a playbook by retrieving it yourself via the graph API, but STAT will not do it today. Please create a feature request: https://github.com/briandelmsft/SentinelAutomationModules/issues/new/choose