[azure-mgmt-securityinsight] Cannot (always) fetch the query attribute in an alert rule

• Package Name: azure-mgmt-securityinsight
• Package Version: 1.0.0
• Operating System: macOS-12.5.1
• Python Version: 3.10.8

Describe the bug I’m currently developing locally an Azure function that communicates with Microsoft Sentinel, in order to fetch the alert rules from it, and more specifically their respective querys :

credentials = AzureCliCredential()
    alert_rules_operations = SecurityInsights(
        credentials, SUBSCRIPTION_ID).alert_rules
    list_alert_rules = alert_rules_operations.list(resource_group_name=os.getenv(
        'RESOURCE_GROUP_NAME'), workspace_name=os.getenv('WORKSPACE_NAME'))

The issue is that when I’m looping over list_alert_rules, and try to see each rule’s query, I get an error: Exception: AttributeError: 'FusionAlertRule' object has no attribute 'query'. Yet, when I check their type via the type() function:

list_alert_rules = alert_rules_operations.list(resource_group_name=os.getenv(
        'RESOURCE_GROUP_NAME'), workspace_name=os.getenv('WORKSPACE_NAME'))
for rule in list_alert_rules:
     print(type(rule))
##console: <class 'azure.mgmt.securityinsight.models._models_py3.ScheduledAlertRule'>

The weirder issue is that this error appears only when you don’t print the attribute. Let me show you:

• Print:

for rule in list_alert_rules:
     query = rule.query
     print('query', query)
##console: query DATABASE_NAME | where TABLE_NAME... blabla

No error. The object returns the necessary info. However when I don’t request to print it:

• No print:

for rule in list_alert_rules:
     query = rule.query
        ...
##console: Exception: AttributeError: 'FusionAlertRule' object has no attribute 'query'.

To Reproduce Steps to reproduce the behavior:

1. Try to fetch Sentinel alert rules, and to get their respective queries via the Python SDK.

Expected behavior I expect to be always able to fetch the query attribute, whether I’m printing it in the console or not.

TIA!

[msyyc]

Hi @FaresKi According to the description of “AlertRule”: https://github.com/Azure/azure-sdk-for-python/blob/e00c844abc68b2e7a75397cad898f37c2aea0393/sdk/securityinsight/azure-mgmt-securityinsight/azure/mgmt/securityinsight/models/_models_py3.py#L2022-L2027 It means that service will return list of sub-class of AlertRule. During the sub-class, only a few sub-class has “query” attribute while some are not like: https://github.com/Azure/azure-sdk-for-python/blob/e00c844abc68b2e7a75397cad898f37c2aea0393/sdk/securityinsight/azure-mgmt-securityinsight/azure/mgmt/securityinsight/models/_models_py3.py#L20270-L20342. So before use “query”, you need to check whether it exists like:

for rule in list_alert_rules:
     if hasattr(rule, "query"):
        ...

[FaresKi]

Alright, I see. Thanks guys!