Skip to content

SQLParser - Statement gets truncated #3968

Closed
Closed
SQLParser - Statement gets truncated#3968

Description

@guarismo
Igor Guarisma (guarismo)
opened on Jan 20, 2022

This is not capturing the whole statement, it gets truncated.

Azure-Sentinel/Parsers/SQLSever/SQLServer_Parser.txt

Line 31 in 28c966e

"statement:" Statement:string

To fix I added the next field extraction below it:

| parse RenderedDescription with * "database_name:" DatabaseName:string
"schema_name:" Temp:string
"object_name:" ObjectName:string
"statement:" Statement:string
"additional_information:" AdditionalInfo:string
"." *

Activity

  1. github-actions commented on Jan 20, 2022

    @github-actions
    github-actionsbot
    on Jan 20, 2022
    Contributor

    Thank you for submitting an Issue to the Azure Sentinel GitHub repo! You should expect an initial response to your Issue from the team within 5 business days. Note that this response may be delayed during holiday periods. For urgent, production-affecting issues please raise a support ticket via the Azure Portal.

  2. Igor Guarisma (guarismo)
    changed the title [-]Statement gets truncated[/-] [+]SQLParser - Statement gets truncated[/+] on Jan 20, 2022

  3. github-actions commented on Jan 20, 2022

    @github-actions
    github-actionsbot
    on Jan 20, 2022
    Contributor

    Thank you for submitting an Issue to the Azure Sentinel GitHub repo! You should expect an initial response to your Issue from the team within 5 business days. Note that this response may be delayed during holiday periods. For urgent, production-affecting issues please raise a support ticket via the Azure Portal.

  4. Samik Roy (samikroy)
    added a commit that references this issue on Jan 21, 2022

    Fix for Azure#3968

    c009b1d

  5. aprakash13 commented on Feb 1, 2022

    @aprakash13
    aprakash13
    on Feb 1, 2022
    Contributor

    Fixed by the PR 3977 by Samik Roy (@samikroy)

  6. aprakash13
    closed this as completedon Feb 1, 2022

  7. github-actions commented on Feb 1, 2022

    @github-actions
    github-actionsbot
    on Feb 1, 2022
    Contributor

    Thank you for submitting an Issue to the Azure Sentinel GitHub repo! You should expect an initial response to your Issue from the team within 5 business days. Note that this response may be delayed during holiday periods. For urgent, production-affecting issues please raise a support ticket via the Azure Portal.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions