Sentinel Repo Fails to deploy

DWilliams-9263 0

Able to authorize and start the addition of the repo. Keep getting this error for 2 of 4 deployments. Not sure which table this is referring to. Or where 'productFilter' is coming from. Just trying to get the Repo initially set up.

Status Message: Failed to run the analytics rule query. One of the tables does not exist. (Code:BadRequest)

Status Message: Required property 'productFilter' not found in JSON. Path 'properties', line 3, position 17. (Code:BadRequest)

Andrew Blumhardt 9,491 Reputation points Microsoft Employee

2023-03-20T20:19:53.23+00:00

We probably need more info here. Do you have a link to the template.
DWilliams-9263 0 Reputation points

2023-03-20T20:56:23.9133333+00:00

Currently using Azure DevOps for my repositories. Linked template was the same one used that had errors. All the rules are Microsoft built-in rules. Template only contains analytic rules
Andrew Blumhardt 9,491 Reputation points Microsoft Employee

2023-03-21T21:20:10.8266667+00:00

I haven't worked much with the repositories integration. Are you using a sample repository? The docs reference a validation process.

https://learn.microsoft.com/en-us/azure/sentinel/ci-cd-custom-content#validate-your-content
Ashley Roy 80 Reputation points

2023-03-23T13:29:15.9833333+00:00

It appears that the error is related to an analytics rule query that is missing a required property, 'productFilter'. It is likely that the analytics rule query is referring to a table in the repo that does not exist, or is missing the required property. To resolve this issue, you will need to either create the missing table or add the missing property to an existing table.
CJ Tarbox 0 Reputation points

2023-03-24T21:10:04.2066667+00:00

having same issue - following
JamesTran-MSFT 36,366 Reputation points Microsoft Employee

2023-04-05T19:11:09.8833333+00:00

@DWilliams-9263 I wanted to check in and see if you had any other questions or if you were able to resolve this issue?

If you have any other questions, please let me know. Thank you for your time and patience throughout this issue.
Sebastian Wiszowaty 5 Reputation points

2023-08-24T07:24:35.19+00:00

@JamesTran-MSFT it would be nice if the rules could still deploy albeit with a tag [table evaluation failed] or something of the sort. As due to the nature of data connectors, when you deploy a whole solution as MSSP they don't get populated straight away, or there are connectors that the customer needs to set up manually due to them not being possible to be enabled by MSSP due to rg permissions and them needing either tenant/sub/mgmt group level permissions.

This would allow MSSPs to deploy solutions, without having to delay the solution deployment, or figuring out a way to get the content to a state where every table exists - by having to parse/investigate what tables are currently on env, and then applying that to some filtering scripts.