Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[cloud::microsoft::office365::onedrive::plugin] - sharepoint e onedrive discovery failed #5238

Open
joschi99 opened this issue Oct 14, 2024 · 8 comments

Comments

@joschi99
Copy link
Contributor

latest plugins. The discovery of Onedrive and Sharepoint will return as last line a value like

2024-10-12,99b2a51a-06d5-4787-99db-1fe5c72f1dc6,,Roman Morandell,False,2024-10-11,374,7,257496988,1099511627776,[email protected],7
2024-10-12,b791fb1c-3f15-4297-a220-5dedb35ac21b,,Alessio Piu,False,2024-07-23,3,0,6305758,1099511627776,[email protected],7
2024-10-12,f20733fa-1cba-4bd7-b0eb-4e2605d11576,,Dario Bella,False,2024-09-24,121,0,3239104988,1099511627776,[email protected],7
2024-10-12,f3ebb5a8-42c5-4490-9deb-3d09617f1415,,Paolo Ferrari,False,2024-10-11,161,2,1047692096,1099511627776,[email protected],7
[owner = Paolo Ferrari] [url = ]

The last line seem's new and in the past I don't remember that was present. Could we exclude it?

@lucie-dubrunfaut
Copy link
Contributor

Hello :)

Apparently there have been no recent changes to the Onedrive and Sharepoint plugins (apart from updating their official documentation). CF the history of listsites.pm modes:
listsites-Onedrive
listsites-Sharepoint

From what I can see, the last line seems to correspond to the ‘long’ message output, in other words induce by the --verboseoption.

$self->{output}->output_add(long_msg => sprintf("[owner = %s] [url = %s]",

@joschi99
Copy link
Contributor Author

joschi99 commented Oct 14, 2024

There seem's something strange. when i discovery by CLI without any --verbose or --debug the I will get this output returned by --plugin=cloud::microsoft::office365::onedrive::plugin --mode=list-sites

List sites:
[owner = Paolo Ferrari] [url = ]

When I do it with --debug then I can see the hole list of Onedrives:

Report Refresh Date,Site Id,Site URL,Owner Display Name,Is Deleted,Last Activity Date,File Count,Active File Count,Storage Used (Byte),Storage Allocated (Byte),Owner Principal Name,Report Period
2024-10-12,1f92ee69-3805-4e71-bb5b-f31b609f9ad5,,Felix Geier,False,2024-10-04,328,0,987268614,1099511627776,[email protected],7
2024-10-12,36cb5e9d-4a7d-45ba-816f-e44609976862,,Sepaseh Hakiminejad,False,2024-09-30,56,0,186043593,1099511627776,[email protected],7
2024-10-12,37a1306a-9c6b-43a7-ab74-e847f9bcb1f2,,Barney Worrad,True,2024-05-27,77,0,4111522371,1099511627776,[email protected],7
2024-10-12,5e57b937-f921-4f35-8aaf-76350852fa2a,,Jochen Platzgummer,False,2024-10-12,934,9,23331966541,1099511627776,[email protected],7
2024-10-12,641ff9bd-c3f4-4741-9e72-dcd86113304f,,Roberto Davide Gambuti,False,2024-10-10,395,6,21548780897,1099511627776,[email protected],7
2024-10-12,6d47d5ae-a558-47c8-8331-2e5a7713158c,,Sales France,False,2023-07-17,15,0,83989978,1099511627776,[email protected],7
2024-10-12,7047746f-38cc-41b1-9fd8-3f7b6b6c6362,,Riccardo Bicelli,False,2024-10-12,5,3,1394668,1099511627776,[email protected],7
2024-10-12,87f66aa5-a461-4763-84e8-d64fe1d20306,,Karl Hafele,False,2024-10-08,7190,19,65484969477,1099511627776,[email protected],7
2024-10-12,99b2a51a-06d5-4787-99db-1fe5c72f1dc6,,Roman Morandell,False,2024-10-11,374,7,257496988,1099511627776,[email protected],7
2024-10-12,b791fb1c-3f15-4297-a220-5dedb35ac21b,,Alessio Piu,False,2024-07-23,3,0,6305758,1099511627776,[email protected],7
2024-10-12,f20733fa-1cba-4bd7-b0eb-4e2605d11576,,Dario Bella,False,2024-09-24,121,0,3239104988,1099511627776,[email protected],7
2024-10-12,f3ebb5a8-42c5-4490-9deb-3d09617f1415,,Paolo Ferrari,False,2024-10-11,161,2,1047692096,1099511627776,[email protected],7
[owner = Paolo Ferrari] [url = ]

And on both outputs the last line is present.

@joschi99
Copy link
Contributor Author

Hi @lucie-dubrunfaut,
did you see the problem?

@lucie-dubrunfaut
Copy link
Contributor

Hello :)

I tried to work on it by comparing it with other discovery rules. Can you tell me if the behavior with the disco-show and disco-format options is normal?

@joschi99
Copy link
Contributor Author

The behaviour is still the same, only the output format is json:

@lucie-dubrunfaut
Copy link
Contributor

Hello :)

I don't think I can go much further without having a dataset to test the issue locally in a dev env. Do you think you can provide me with this data?

@joschi99
Copy link
Contributor Author

joschi99 commented Nov 5, 2024

Hi Lucie,
did you need some credentials? If you need I can share something with you.

@lucie-dubrunfaut
Copy link
Contributor

I think I can just use the output from the API call for this endpoints :
/v1.0/reports/getOneDriveUsageAccountDetail(period='D7')
and
/v1.0/reports/getSharePointSiteUsageDetail(period='D7')
(you can anonymize the outputs if needed).

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants