I am trying to loop through Azure Audit Logs and have created and HTTP GET request. I have configured a Parse JSON step and entered a JSON sample of the data. This lists the relevant fields and I can apply it to an Apply to Each loop. However, when I run it I get an error that the array is null. I can see that multiple results have been retrieved and I've been through the JSON to allow null values, but it still errors. banging my head against a wall with this one, so any pointers would be great.
The http GET request is using the URI: https://graph.microsoft.com/v1.0/auditLogs/directoryAudits?%24filter=activityDisplayName%20eq%20'Delete%20group'
This is the JSON I am now using (note I have put tons of entries to allow null values which I know is overkill, but was getting nowhere):
{
"type": "object",
"properties": {
"statusCode": {
"type": "integer"
},
"headers": {
"type": "object",
"properties": {
"Transfer-Encoding": {
"type": "string"
},
"Vary": {
"type": "string"
},
"Strict-Transport-Security": {
"type": "string"
},
"request-id": {
"type": "string"
},
"client-request-id": {
"type": "string"
},
"x-ms-ags-diagnostic": {
"type": "string"
},
"OData-Version": {
"type": "string"
},
"Date": {
"type": "string"
},
"Content-Type": {
"type": "string"
},
"Content-Length": {
"type": "string"
}
}
},
"body": {
"type": "object",
"properties": {
"@@odata.context": {
"type": "string"
},
"@@odata.nextLink": {
"type": "string"
},
"value": {
"type": "array",
"items": {
"type": "object",
"properties": {
"id": {
"type": "string"
},
"category": {
"type": [
"string",
"null"
]
},
"correlationId": {
"type": [
"string",
"null"
]
},
"result": {
"type": [
"string",
"null"
]
},
"resultReason": {
"type": [
"string",
"null"
]
},
"activityDisplayName": {
"type": [
"string",
"null"
]
},
"activityDateTime": {
"type": [
"string",
"null"
]
},
"loggedByService": {
"type": [
"string",
"null"
]
},
"operationType": {
"type": [
"string",
"null"
]
},
"initiatedBy": {
"type": [
"object",
"null"
],
"properties": {
"user": {},
"app": {
"type": "object",
"properties": {
"appId": {},
"displayName": {
"type": "string"
},
"servicePrincipalId": {
"type": "string"
},
"servicePrincipalName": {}
}
}
}
},
"targetResources": {
"type": [
"array",
"null"
],
"items": {
"type": [
"object",
"null"
],
"properties": {
"id": {
"type": "string"
},
"displayName": {
"type": [
"string",
"null"
]
},
"type": {
"type": [
"string",
"null"
]
},
"userPrincipalName": {
"type": [
"string",
"null"
]
},
"groupType": {
"type": [
"string",
"null"
]
},
"modifiedProperties": {
"type": [
"array",
"null"
],
"items": {
"type": "object",
"properties": {
"displayName": {
"type": [
"string",
"null"
]
},
"oldValue": {
"type": [
"string",
"null"
]
},
"newValue": {
"type": [
"string",
"null"
]
}
},
"required": [
"displayName",
"oldValue",
"newValue"
]
}
}
},
"required": [
"id",
"displayName",
"type",
"userPrincipalName",
"groupType",
"modifiedProperties"
]
}
},
"additionalDetails": {
"type": [
"array",
"null"
],
"items": {
"type": "object",
"properties": {
"key": {
"type": [
"string",
"null"
]
},
"value": {
"type": [
"string",
"null"
]
}
},
"required": [
"key",
"value"
]
}
}
},
"required": [
"id",
"category",
"correlationId",
"result",
"resultReason",
"activityDisplayName",
"activityDateTime",
"loggedByService",
"operationType",
"initiatedBy",
"targetResources",
"additionalDetails"
]
}
}
}
}
}
}
"type": "object",
"properties": {
"statusCode": {
"type": "integer"
},
"headers": {
"type": "object",
"properties": {
"Transfer-Encoding": {
"type": "string"
},
"Vary": {
"type": "string"
},
"Strict-Transport-Security": {
"type": "string"
},
"request-id": {
"type": "string"
},
"client-request-id": {
"type": "string"
},
"x-ms-ags-diagnostic": {
"type": "string"
},
"OData-Version": {
"type": "string"
},
"Date": {
"type": "string"
},
"Content-Type": {
"type": "string"
},
"Content-Length": {
"type": "string"
}
}
},
"body": {
"type": "object",
"properties": {
"@@odata.context": {
"type": "string"
},
"@@odata.nextLink": {
"type": "string"
},
"value": {
"type": "array",
"items": {
"type": "object",
"properties": {
"id": {
"type": "string"
},
"category": {
"type": [
"string",
"null"
]
},
"correlationId": {
"type": [
"string",
"null"
]
},
"result": {
"type": [
"string",
"null"
]
},
"resultReason": {
"type": [
"string",
"null"
]
},
"activityDisplayName": {
"type": [
"string",
"null"
]
},
"activityDateTime": {
"type": [
"string",
"null"
]
},
"loggedByService": {
"type": [
"string",
"null"
]
},
"operationType": {
"type": [
"string",
"null"
]
},
"initiatedBy": {
"type": [
"object",
"null"
],
"properties": {
"user": {},
"app": {
"type": "object",
"properties": {
"appId": {},
"displayName": {
"type": "string"
},
"servicePrincipalId": {
"type": "string"
},
"servicePrincipalName": {}
}
}
}
},
"targetResources": {
"type": [
"array",
"null"
],
"items": {
"type": [
"object",
"null"
],
"properties": {
"id": {
"type": "string"
},
"displayName": {
"type": [
"string",
"null"
]
},
"type": {
"type": [
"string",
"null"
]
},
"userPrincipalName": {
"type": [
"string",
"null"
]
},
"groupType": {
"type": [
"string",
"null"
]
},
"modifiedProperties": {
"type": [
"array",
"null"
],
"items": {
"type": "object",
"properties": {
"displayName": {
"type": [
"string",
"null"
]
},
"oldValue": {
"type": [
"string",
"null"
]
},
"newValue": {
"type": [
"string",
"null"
]
}
},
"required": [
"displayName",
"oldValue",
"newValue"
]
}
}
},
"required": [
"id",
"displayName",
"type",
"userPrincipalName",
"groupType",
"modifiedProperties"
]
}
},
"additionalDetails": {
"type": [
"array",
"null"
],
"items": {
"type": "object",
"properties": {
"key": {
"type": [
"string",
"null"
]
},
"value": {
"type": [
"string",
"null"
]
}
},
"required": [
"key",
"value"
]
}
}
},
"required": [
"id",
"category",
"correlationId",
"result",
"resultReason",
"activityDisplayName",
"activityDateTime",
"loggedByService",
"operationType",
"initiatedBy",
"targetResources",
"additionalDetails"
]
}
}
}
}
}
}
Categories: