Fix Microsoft Sentinel mirroring BadRequest

Packs/AzureSentinel/Integrations/AzureSentinel/AzureSentinel.py

@@ -17,6 +17,7 @@
 APP_NAME = 'ms-azure-sentinel'
 
 DATE_FORMAT = '%Y-%m-%dT%H:%M:%SZ'
+DATE_FORMAT_WITH_MILLISECONDS = '%Y-%m-%dT%H:%M:%S.%fZ'
 
 API_VERSION = '2022-11-01'
 
@@ -509,7 +510,8 @@ def get_modified_remote_data_command(client: AzureSentinelClient, args: Dict[str
         GetModifiedRemoteDataResponse object, which contains a list of the modified incidents IDs.
     """
     remote_args = GetModifiedRemoteDataArgs(args)
-    last_update = remote_args.last_update
+    last_update = dateparser.parse(remote_args.last_update, settings={'TIMEZONE': 'UTC'}).strftime(  # type: ignore[union-attr]
+        DATE_FORMAT_WITH_MILLISECONDS)
     demisto.debug(f'Getting modified incidents from {last_update}')
 
     raw_incidents = []

Packs/AzureSentinel/Integrations/AzureSentinel/AzureSentinel.yml

@@ -150,7 +150,7 @@ configuration:
   - Outgoing
   - Incoming And Outgoing
   hidden:
-    - marketplacev2
+  - marketplacev2
   section: Collect
 - additionalinfo: When selected, closing the Microsoft Sentinel ticket is mirrored in Cortex XSOAR.
   defaultvalue: 'false'
@@ -159,7 +159,7 @@ configuration:
   required: false
   type: 8
   hidden:
-    - marketplacev2
+  - marketplacev2
   section: Collect
   advanced: true
 - additionalinfo: When selected, closing the Cortex XSOAR incident is mirrored in Microsoft Sentinel.
@@ -169,7 +169,7 @@ configuration:
   required: false
   type: 8
   hidden:
-    - marketplacev2
+  - marketplacev2
   section: Collect
   advanced: true
 description: "Microsoft Sentinel is a scalable, cloud-native solution that provides: Security information and event management (SIEM) Security orchestration, automation, and response (SOAR)."
@@ -2570,10 +2570,10 @@ script:
       name: severity
       required: false
       predefined:
-        - informational
-        - low
-        - medium
-        - high
+      - informational
+      - low
+      - medium
+      - high
     - default: false
       description: |
         The suppression (in ISO 8601 duration format: PnYnMnDTnHnMnS or PnW) to wait since the last time this alert rule was triggered.
@@ -2590,8 +2590,8 @@ script:
       name: suppression_enabled
       required: false
       predefined:
-        - yes
-        - no
+      - yes
+      - no
     - auto: PREDEFINED
       default: false
       description: |
@@ -2601,10 +2601,10 @@ script:
       name: trigger_operator
       required: false
       predefined:
-        - equal
-        - greater_than
-        - less_than
-        - not_equal
+      - equal
+      - greater_than
+      - less_than
+      - not_equal
     - default: false
       description: |
         The threshold that triggers this alert rule.
@@ -2848,10 +2848,10 @@ script:
       name: severity
       required: false
       predefined:
-        - informational
-        - low
-        - medium
-        - high
+      - informational
+      - low
+      - medium
+      - high
     - default: false
       description: |
         The suppression (in ISO 8601 duration format: PnYnMnDTnHnMnS or PnW) to wait since the last time this alert rule was triggered.
@@ -2868,8 +2868,8 @@ script:
       name: suppression_enabled
       required: false
       predefined:
-        - yes
-        - no
+      - yes
+      - no
     - auto: PREDEFINED
       default: false
       description: |
@@ -2879,10 +2879,10 @@ script:
       name: trigger_operator
       required: false
       predefined:
-        - equal
-        - greater_than
-        - less_than
-        - not_equal
+      - equal
+      - greater_than
+      - less_than
+      - not_equal
     - default: false
       description: |
         The threshold that triggers this alert rule.
@@ -3006,7 +3006,7 @@ script:
     - contextPath: AzureSentinel.AlertRule.properties.incidentConfiguration
       description: The settings of the incidents that were created from alerts triggered by this analytics rule.
       type: Unknown
-  dockerimage: demisto/crypto:1.0.0.58768
+  dockerimage: demisto/crypto:1.0.0.61689
   feed: false
   isfetch: true
   longRunning: false

Packs/AzureSentinel/Integrations/AzureSentinel/AzureSentinel_test.py

@@ -1490,7 +1490,11 @@ def test_fetch_incidents_additional_info(mocker, incidents):
         assert incident['entities'] == [{'id': f'entities-{i + 1}'}]
 
 
-def test_get_modified_remote_data_command(mocker):
+@pytest.mark.parametrize("last_update, expected_last_update", [
+    ('2023-01-06T08:17:09.001016488+02:00', '2023-01-06T06:17:09.001016Z'),
+    ('2023-01-06T08:17:09.001016488Z', '2023-01-06T08:17:09.001016Z')
+])
+def test_get_modified_remote_data_command(mocker, last_update, expected_last_update):
     """
     Given
         - client
@@ -1505,9 +1509,9 @@ def test_get_modified_remote_data_command(mocker):
     mock_response = {'value': [{'name': 'incident-1'}, {'name': 'incident-2'}]}
     mocker.patch.object(client, 'http_request', return_value=mock_response)
 
-    last_update = '2023-01-06T08:17:09Z'
     result = get_modified_remote_data_command(client, {'lastUpdate': last_update})
-    assert last_update in client.http_request.call_args[1]['params']['$filter']
+    excepted_filter = f'properties/lastModifiedTimeUtc ge {expected_last_update}'
+    assert client.http_request.call_args[1]['params']['$filter'] == excepted_filter
     assert result.modified_incident_ids == [incident['name'] for incident in mock_response['value']]
 
 

Packs/AzureSentinel/ReleaseNotes/1_5_7.md

@@ -0,0 +1,7 @@
+
+#### Integrations
+
+##### Microsoft Sentinel
+
+- Fixed an issue where the ***get-modified-remote-data*** command did not work correctly with non-UTC timezones.
+- Updated the Docker image to: *demisto/crypto:1.0.0.61689*.

Packs/AzureSentinel/pack_metadata.json

@@ -2,7 +2,7 @@
     "name": "Microsoft Sentinel",
     "description": "Microsoft Sentinel is a cloud-native security information and event manager (SIEM) platform that uses built-in AI to help analyze large volumes of data across an enterprise.",
     "support": "xsoar",
-    "currentVersion": "1.5.6",
+    "currentVersion": "1.5.7",
     "author": "Cortex XSOAR",
     "url": "https://www.paloaltonetworks.com/cortex",
     "email": "",