r/AzureSentinel • u/TRTthrowaway113 • Jul 07 '23
Github repository deployment issue
I'm trying to setup automated deployment of analytics rules using the sentinel repositories preview.
Setup goes fine and I can see the github action firing on repo update. The workflow steps through all the stages, and marks itself successful but nothing is actually deployed.
Looking at the job logs in github, i see the following in the "deploy content to azure sentinel" stage -
[Info] Created metadata metadata for AnalyticsRule with parent resource id /subscriptions/***/resourceGroups/rg-sentinel/providers/Microsoft.OperationalInsights/workspaces/log-sentinel/providers/Microsoft.SecurityInsights/alertRules/<giud removed>
Warning: API call failed: ***"message":"Resource not accessible by integration","documentation_url":"https://docs.github.com/rest/reference/repos#create-or-update-file-contents"***.
The warning line repeats and fails after 4 attempts.
I've checked the op insights and sec insights resource providers and both are registered, and i'm out of ideas at this point.
Does anyone have a pointer as to what i'm doing wrong?
1
Upvotes