Get-MDEInvestigationPackage playbook retrives SAS URI but returns "expired token"

[applefacts]

Describe the bug A clear and concise description of what the bug is.

This playbook https://github.com/Azure/Azure-Sentinel/tree/master/Playbooks/Get-MDEInvestigationPackage Is ran against a Sentinel Incident and it is able to retrieve the get investigation package download URI. However when I navigate to the URL I get a JSON error Message: "Expired token"

To Reproduce Steps to reproduce the behavior:

1. Go to 'Sentinel Incident'
2. Click on 'Run Playbook (Preview)'
3. Select Get-MDEInvestigationPackage and click "Run"
4. See error

Expected behavior A clear and concise description of what you expected to happen.

URL from playbook is supposed to download the investigation package

Screenshots If applicable, add screenshots to help explain your problem.

See above

Desktop (please complete the following information):

• OS: Windows 11
• Browser Firefox
• Version 104.0.2

Additional context Add any other context about the problem here. Permissions as per readme were granted to managed identity.

[github-actions[bot]]

Thank you for submitting an Issue to the Azure Sentinel GitHub repo! You should expect an initial response to your Issue from the team within 5 business days. Note that this response may be delayed during holiday periods. For urgent, production-affecting issues please raise a support ticket via the Azure Portal.

[github-actions[bot]]

Thank you for submitting an Issue to the Azure Sentinel GitHub repo! You should expect an initial response to your Issue from the team within 5 business days. Note that this response may be delayed during holiday periods. For urgent, production-affecting issues please raise a support ticket via the Azure Portal.

[github-actions[bot]]

Thank you for submitting an Issue to the Azure Sentinel GitHub repo! You should expect an initial response to your Issue from the team within 5 business days. Note that this response may be delayed during holiday periods. For urgent, production-affecting issues please raise a support ticket via the Azure Portal.

[BenjiSec]

Hi @kevelife - we are currently investigating why there is error with expired token. in meantime you can utilize HTTP action as a workaround

[github-actions[bot]]

Thank you for submitting an Issue to the Azure Sentinel GitHub repo! You should expect an initial response to your Issue from the team within 5 business days. Note that this response may be delayed during holiday periods. For urgent, production-affecting issues please raise a support ticket via the Azure Portal.

[github-actions[bot]]

Thank you for submitting an Issue to the Azure Sentinel GitHub repo! You should expect an initial response to your Issue from the team within 5 business days. Note that this response may be delayed during holiday periods. For urgent, production-affecting issues please raise a support ticket via the Azure Portal.

[BenjiSec]

Update - API token to get investigation package expires couple of minutes after generating by design, so if you don't click on the link immediately, you will get "token expired" notification.

[v-mchatla]

@BenjiSec - Thaks for the prompt response. @applefacts - Closing this incident as its by design and please feel free to reopen if you need any further information on this. Thanks

[github-actions[bot]]

Thank you for submitting an Issue to the Azure Sentinel GitHub repo! You should expect an initial response to your Issue from the team within 5 business days. Note that this response may be delayed during holiday periods. For urgent, production-affecting issues please raise a support ticket via the Azure Portal.

[applefacts]

Update - API token to get investigation package expires couple of minutes after generating by design, so if you don't click on the link immediately, you will get "token expired" notification.

Hi @BenjiSec, I am clicking the package URL immediately and I am not waiting for it to expire.

[KrisDeb78]

The token life is definitely too short for this use case - I've managed to download it clicking refresh on the incident page only during the second run (2 minutes); after the first, 5 minutes run, the token was already expired. I can see that the token life is something between 4-5 minutes in total, please correct me if I'm wrong. Anyway, as I said, it is way too short for the production use.