ben.carrasco/prowler
1
0
Fork 0
mirror of https://github.com/prowler-cloud/prowler.git synced 2026-07-24 21:11:53 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix(m365): drop misleading fallbacks when parsing PIM alert incidents

Browse Source 
The DirectoryRoleStaleSignInAlertIncident schema does not expose 'subject',
'createdDateTime', or any field whose 'id' represents the affected user, so
the previous fallbacks silently substituted the wrong values and made
status_extended messages refer to the incident GUID instead of the actual
user when the API response omitted assigneeId/assigneeDisplayName.

Read each field directly from the documented incident properties so an
empty value stays empty rather than being papered over with unrelated
data.
This commit is contained in:
Hugo P.Brito
2026-05-11 12:00:08 +01:00
parent b49e49f543
commit ce8f6037c1
1 changed files with 10 additions and 14 deletions
Download Patch File Download Diff File Expand all files Collapse all files
prowler/providers/m365/services/entra/entra_service.py
+10 -14
View File
@@ -1086,22 +1086,18 @@ OAuthAppInfo
incidents = alert.get("alertIncidents", [])
affected_items = []
for incident in incidents:
assignee_display_name = incident.get(
"assigneeDisplayName", ""
) or incident.get("subject", "")
assignee_id = incident.get("assigneeId", "") or incident.get(
"id", ""
)
role_display_name = incident.get("roleDisplayName", "")
last_sign_in = incident.get(
"lastSignInDateTime", ""
) or incident.get("createdDateTime", "")
affected_items.append(
PimAlertIncident(
assignee_display_name=assignee_display_name,
assignee_id=assignee_id,
role_display_name=role_display_name,
last_sign_in_date_time=last_sign_in,
assignee_display_name=incident.get(
"assigneeDisplayName", ""
),
assignee_id=incident.get("assigneeId", ""),
role_display_name=incident.get(
"roleDisplayName", ""
),
last_sign_in_date_time=incident.get(
"lastSignInDateTime", ""
),
)
)
pim_alerts[alert_definition_id] = PimAlert(