[BUG] Exchange Online module returning "Bad Request", failing with TypeError

[jocelynjyl]

Describe the bug
Exchange module failing Out of Office check when Out of Office is set with a specified time range. This might be fixed by explicitly casting results['scheduledStartDateTime']['dateTime'] and results['scheduledEndDateTime']['dateTime'] as datetime objects in exchange.py.

Module Name
Exchange Online Module

To Reproduce
Steps to reproduce the behavior:

1. Identify an incident or use a testing incident with a user entity
2. Enable automatic replies for user, check "Only send during this time range" and select a time range.
3. Run the STAT triage playbook with Exchange module on the incident.

Expected behavior
Module should return the user is Out of Office.

Additional context
Error log from a failing STAT triage playbook run:

"Error": "Module processing failed, an unknown exception has occurred.",
"InvocationId": -redacted-,
"STATVersion": "2.2.0",
"Traceback": [
"Traceback (most recent call last):\n",
" File "/home/site/wwwroot/modules/init.py", line 19, in main\n return_data = coordinator.initiate_module(module_name=module_name, req_body=req_body)\n",
" File "/home/site/wwwroot/shared/coordinator.py", line 35, in initiate_module\n return_data = exchange.execute_exchange_module(req_body)\n",
" File "/home/site/wwwroot/modules/exchange.py", line 27, in execute_exchange_module\n oof_check(base_object, exch, upn)\n",
" File "/home/site/wwwroot/modules/exchange.py", line 122, in oof_check\n elif results['status'].lower() == 'scheduled' and current_time >= results['scheduledStartDateTime']['dateTime'] \\n",
"TypeError: '>=' not supported between instances of 'datetime.datetime' and 'str'\n"
]

[briandelmsft]

@jocelynjyl thanks for the report, we will be investigating it

[briandelmsft]

@jocelynjyl this will be fixed in the next build. I can put together a preview build if you like but it will contain other new features that are still in development so it could introduce other issues so it wouldn't be recommended for production use at this time

[jocelynjyl]

Thank you @briandelmsft ! Do you have an ETA for the next build release?

[briandelmsft]

@jocelynjyl The next stable build will likely be mid August, but it may be later. I could have a preview next week but it may not be production ready (though you could easily flip back to the stable build if you have issues)

[jocelynjyl]

No worries, I'll wait for the next stable build. Thanks again.

[briandelmsft]

@jocelynjyl we're looking at more like mid September for the next stable build. There is a preview build though that fixes this issue. You will need to change you function app to run Python 3.12 and use the py312 file from this build if you want to try it: https://github.com/briandelmsft/STAT-Function/releases/tag/v2.2.6

This build introduces some capabilities around mailMessage entity analysis which to use requires a new permission. It won't fail if you don't have the permission, but the new capabilities won't work without it. The updated permissions script is at https://raw.githubusercontent.com/briandelmsft/SentinelAutomationModules/refs/heads/python312/Deploy/GrantPermissions.ps1

[carliecangelosi]

Hi! @briandelmsft is there any update on this release?

[briandelmsft]

@carliecangelosi unfortunately I have been swamped and haven't had the time to finish it, I have one minor issue that I can't reproduce in the 2.2.6 build that I am trying to get some data to better understand before I release. The build itself is quite good, the issue is only with the new functionality and only on select mail message enrichments that don't complete.

[carliecangelosi]

@briandelmsft thank you for the update! No worries and no rush, super excited for the release so we can get back up and running!