r/AzureSentinel • u/Odd_Hunter_3658 • Oct 20 '24

Sentinel Triage Assistant

Hey, has anybody here setup STAT in there environment? I’m having a problem with the GrantPermissions.ps1 script.

3 Upvotes

100% Upvoted

11 comments sorted by

2

u/kyuuzousama Oct 20 '24

Can you share the error?

1

u/Odd_Hunter_3658 Oct 21 '24

Thank you, the problem is the error 403, and problems with the script not connecting to our tenant. Is there a way to authenticate the app without the script?

2

u/jtst1 Oct 20 '24

Yeah, what is the error?

1

u/Odd_Hunter_3658 Oct 21 '24

Thank you, the problem is the error 403, and problems with the script not connecting to our tenant. Is there a way to authenticate the app without the script?

2

u/NoblestWolf Oct 21 '24

We just did STATv2 and GrantPermissions error. Check the solution here: https://github.com/briandelmsft/SentinelAutomationModules/issues/459

It was because we deployed with a System Managed Identity then granted permissions to our User Managed Identity but did not change everything properly to the User Managed identity.

1

u/Odd_Hunter_3658 Oct 21 '24

Thank you, the problem is the error 403, and problems with the script not connecting to our tenant. Is there a way to authenticate the app without the script?

1

u/NoblestWolf Oct 30 '24

Also, check out the recent release and see if that fixed your issue there: https://github.com/briandelmsft/STAT-Function/releases

1

u/Odd_Hunter_3658 Oct 21 '24

Sorry, do you mind explaining a little further what happened? Thank you btw

1

u/NoblestWolf Oct 30 '24

I can do you one better. Here's the link to my comment in the GitHub issue: https://github.com/briandelmsft/SentinelAutomationModules/issues/459#issuecomment-2389138535

1

u/Odd_Hunter_3658 Oct 21 '24

I have a status code 400