Skip to content

SI-33125: fix token expiry, add trigger checkpointing, add filters to…#3814

Draft
landrisek-r7 wants to merge 1 commit intomasterfrom
SOAR-20866
Draft

SI-33125: fix token expiry, add trigger checkpointing, add filters to…#3814
landrisek-r7 wants to merge 1 commit intomasterfrom
SOAR-20866

Conversation

@landrisek-r7
Copy link
Copy Markdown

Fixes three issues found during escalation SI-33125 where the Azure Sentinel trigger stops picking up incidents after running for a while.

What changed:

api.py — Auth token was set once in init and never refreshed. After ~60 min it expires and all API calls start failing with 401. Now self.headers is a property that checks token TTL and refreshes proactively before expiry.

trigger.py — Polling window was calculated as now - interval on every tick with no state persistence. If the container restarts or lags, incidents in the gap are lost. Now uses self.state to checkpoint the last processed incident timestamp across restarts.

action.py + plugin.spec.yaml — List Incidents action had no support for status or time filters, making the Timer + List Incidents workaround useless. Added optional status and created_from params using the same generate_query_params logic the trigger uses.

Bumped version to 2.2.0.

@snyk-io
Copy link
Copy Markdown

snyk-io bot commented Mar 24, 2026

Snyk checks have passed. No issues have been found so far.

Status Scan Engine Critical High Medium Low Total (0)
Open Source Security 0 0 0 0 0 issues
Licenses 0 0 0 0 0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

@igorski-r7
Copy link
Copy Markdown
Collaborator

This has been address in the following PR (#3822)

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants