Codeless Connector Platform Session authType

Krzysztof Świdrak 166 Reputation points
2022-11-30T12:44:01.547+00:00

Good Day!
I would like to ask if there is some way to handle the parameters for Session type authentication in CCP Sentinel.

"instructionSteps": [  
                        {  
                            "title": "Example",  
                            "description": "Ex Code",  
                            "instructions": [  
                                {  
                                    "parameters": {  
                                        "enable": "true",  
                                        "userRequestPlaceHoldersInput": [  
                                            {  
                                                "displayText": "Access Controller URL",  
                                                "pollingKeyPaths":["$.auth.queryParameters.sessionRequestLoginUri","$.request.apiEndpoint"],  
                                                "placeHolderName": "{{AC_URL}}",  
                                                "placeHolderValue": "https://example.site.here"  
                                            },  
                                            {  
                                                "displayText": "Readonly Account",  
                                                "pollingKeyPaths":["$.auth.queryParameters.username"],  
                                                "placeHolderName": "{{AC_USERNAME}}",  
                                                "placeHolderValue": "sentinel_agent"  
                                            },  
                                            {  
                                                "displayText": "User Password",  
                                                "pollingKeyPaths":["$.auth.queryParameters.password"],  
                                                "placeHolderName": "{{AC_USER_PASSWORD}}",  
                                                "placeHolderValue": ""  
                                            }  
                                        ]  
                                    }  
                                }  
                            ]  
                        }  
                    ]  
                },  
                "pollingConfig": {  
                    "owner": "ASI",  
                    "version": "2.0",  
                    "source": "PaaS",  
                    "auth": {  
                        "authType": "Session",  
                        "sessionRequestLoginUri": "{{AC_URL}}/session",  
                        "queryParameters": {  
                            "username": "{{AC_USERNAME}}",  
                            "password": "{{AC_USER_PASSWORD}}"  
                        }  
                    },  
                    "request": {  
                        "apiEndpoint": "{{AC_URL}}/events",  
                        "rateLimitQPS": 50,  
                        "queryWindowInMin": 5,  
                        "httpMethod": "Get",  
                        "queryTimeFormat": "yyyy-MM-ddTHH:mm:ssZ",  
                        "retryCount": 3,  
                        "timeoutInSeconds": 60,  
                        "headers": {  
                            "Accept": "application/json",  
                            "User-Agent": "Scuba"  
                        }  
                    },  
                    "paging": {  
                        "pagingType": "None"  
                    },  
                    "response": {  
                        "eventsJsonPaths": [  
                            "$"  
                        ]  
                    }  
                }  

It is based on Github example from your showcase.
However after succesfull deployment, the connector itself is not parsed in correct way in sentinel with throwing error:

The following codeless connectors are not valid, and will not be displayed: Connector display name: Example, ConnectorId: /subscriptions/
Microsoft Defender for Cloud
Microsoft Defender for Cloud
An Azure service that provides threat protection for workloads running in Azure, on-premises, and in other clouds. Previously known as Azure Security Center and Azure Defender.
1,199 questions
{count} votes