SecureScoreWorkbook contains invalid JSON about microsoft-defender-for-cloud

[LeeSchuenemeyer]

2 week old issue _ I have the same problem.

[TomJanetscheck]

Hi @kaevans and @LeeSchuenemeyer,
We're currently looking into the issue and will provide a solution once finished. In the meantime, please also take a look at the Azure Monitor workbooks that are published here.

[TomJanetscheck]

Hi @kaevans and @LeeSchuenemeyer
have you tried to redeploy the workbook? On December 4th, the ARM template has been changed to address the issue you're reporting.

[majormer]

I have been working with @LeeSchuenemeyer . The deployment in question was a new deploy last week from scratch.

[TomJanetscheck]

Have you deployed the template with an existing, or a new Log Analytics workspace? Does your workspace contain the following custom log tables?

• SecureScore_CL
• SecureScoreAssessments_CL
• SecureScoreControls_CL
• Subscriptions_CL

If they exist, do the tables contain data?

[majormer]

It was a brand new Log Analytics workspace. I do not see the tables in there.

[TomJanetscheck]

Have you followed the instructions to grant the Logic App's Managed Identity access to your subscriptions? Also, have you manually triggered the Logic App once you have met all prerequisites? These steps are mandatory so the Logic App can read information from Azure Security Center and store it in the Log Analytics Workspace which is provided by the automation (or which is connected when deploying the automation using this template). The workbook uses these custom tables to visualize Secure Score data.

[majormer]

I'm getting a parsing error in the query.

I have granted the Managed Identity read rights to the subscription the Log Analytics RG exists in so that I could get some starting data.

You can assign reader permissions for the Managed Identity for each one of the subscriptions you want to get data on.

Also, everything was deployed exactly from the template link you provided.

[TomJanetscheck]

Have you manually triggered the Logic App? If so, what is the result in the Logic App's run history? Your workspace does not contain the custom tables that are used by the workbook, which means that the Logic App has either not found any Azure Security Center-related data in your subscription, or that it has not propagated the data to the workspace.

The error you get in the screenshot means that the custom table SecureScore_CL has not been found, so there is no data to display.

[majormer]

I have manually triggered the Logic App.

The runs seem to be working fine. I kind of wish they would error so I could see if no data is coming back. As it stands, I just have missing data, I fear.

[TomJanetscheck]

If you take a look at the Logic App run details (just click on one of the succeeded runs on the bottom of your screenshot), the first HTTP step should give you an output that contains your subscription information, such as subscription ID (see the screenshot below). This information is then written to your Log Analytics workspace.

With this step, the Subscriptions_CL table is created in your Log Analytics workspace. If the Logic App does not get the information, the managed identity probably cannot read it. So, you seem to have an issue with your RBAC.

[kaevans]

Hi @kaevans and @LeeSchuenemeyer
have you tried to redeploy the workbook? On December 4th, the ARM template has been changed to address the issue you're reporting.

I believe that @LeeSchuenemeyer should open a different issue as that discussion is not relevant to the issue I've reported. Typically that issue is resolved by waiting 10-15 minutes since custom data written to Log Analytics (as is used in this sample) takes 10-15 minutes to show up in Log Analytics.

In the ARM template for azuredeploy.json in the Get-SecureScoreData project, the ARM template deploys an Azure workbook that is not used by the Logic App or by Power BI. That workbook cannot be opened as it contains several parse errors:

https://github.com/Azure/Azure-Security-Center/blob/7dce4611bbd561c5abb46e931d9739563f9f25c6/Secure%20Score/Get-SecureScoreData/azuredeploy.json#L63

I tried to discern what the queries should actually be so that I could submit a pull request but unsure the intent. Would be helpful to have a workbook deployed that shows some of the Log Analytics queries that are embedded in the PowerBI and use that workbook to confirm that the _CL tables are present.

[TomJanetscheck]

Hi @kaevans
the parsing error you refer to has been addressed in a PR back in December already. The workbook will visualize data from the custom tables that are filled by the Logic App. Have you redeployed the ARM template since then?

[kaevans]

Spoke with @TomJanetscheck , problem exists between chair and keyboard. You have to select the subscription(s) in the workbook. If that parameter says "unset" then you get the parse error. Apologies!