Successful logon from IP and failure from a different IP - missing code line

Describe the bug
The rule name as title states are very noisy in my portal. It seems to be triggering on failed ip and success ip where they actually are the same as well. This is not what the rule is described to do. I therefore added a simple line to avoid this:
| where SuccessIPAddress != FailedIPAddress

Complete rule:
let logonDiff = 10m;
let aadFunc = (tableName:string){
table(tableName)
| where ResultType == "0"
| where AppDisplayName !in ("Office 365 Exchange Online", "Skype for Business Online") // To remove false-positives, add more Apps to this array
| project SuccessLogonTime = TimeGenerated, UserPrincipalName, SuccessIPAddress = IPAddress, AppDisplayName, SuccessIPBlock = strcat(split(IPAddress, ".")[0], ".", split(IPAddress, ".")[1]), Type
| join kind= inner (
    table(tableName)
    | where ResultType !in ("0", "50140")
    | where ResultDescription !~ "Other"
    | where AppDisplayName !in ("Office 365 Exchange Online", "Skype for Business Online") // To remove false-positives, add more Apps to this array
    | project FailedLogonTime = TimeGenerated, UserPrincipalName, FailedIPAddress = IPAddress, AppDisplayName, ResultType, ResultDescription, Type
) on UserPrincipalName, AppDisplayName
| where SuccessLogonTime < FailedLogonTime and FailedLogonTime - SuccessLogonTime <= logonDiff and FailedIPAddress !startswith SuccessIPBlock
| summarize FailedLogonTime = max(FailedLogonTime), SuccessLogonTime = max(SuccessLogonTime) by UserPrincipalName, SuccessIPAddress, AppDisplayName, FailedIPAddress, ResultType, ResultDescription, Type
| extend timestamp = SuccessLogonTime
};
let aadSignin = aadFunc("SigninLogs");
let aadNonInt = aadFunc("AADNonInteractiveUserSignInLogs");
union isfuzzy=true aadSignin, aadNonInt
| extend Name = tostring(split(UserPrincipalName,'@',0)[0]), UPNSuffix = tostring(split(UserPrincipalName,'@',1)[0])
| where SuccessIPAddress != FailedIPAddress

Expected behavior
Should avoid triggering on incidents where the failure and the successfull login are from the same IP, rather when a successfull trigger happens and is followed by a failed IP within 10 minutes on the same app.

Hi @bittib010,
Was this IPV6 by any chance? We have seen this with IPV6 because SuccessIPBlock  relies on a string split, using a period as a delimiter. IPV6 addresses obviously don't have this and are separated by colons instead.
Other than your method excluding if it's an exact match, you can also introduce the same logic by chunking the first part of the IPV6 address into your choice. I have gone for the first few prefixes of an IPv6 address by doing the following:
Take the SuccessIPBlock out of the project statement and put it in an extend. This is done right at the top of the function.
table(tableName)
| where ResultType == "0"
| where AppDisplayName !in ("Office 365 Exchange Online", "Skype for Business Online")
| extend  SuccessIPBlock = strcat(split(IPAddress, ".")[0], ".", split(IPAddress, ".")[1])
| extend SuccessIPBlock = iff(IPAddress contains ":", strcat(split(IPAddress, ":")[0], ":", split(IPAddress, ":")[1] , ":", split(IPAddress, ":")[2], ":", split(IPAddress, ":")[3]), SuccessIPBlock) // take first 4 blocks of IPV6
| project SuccessLogonTime = TimeGenerated, UserPrincipalName, SuccessIPAddress = IPAddress, AppDisplayName, Type, SuccessIPBlock

It seems like IPv6 is the reason behind it, yes. In combination this seem to work, in theory at least. I also adjusted the project in your snippet to fit the rest of the code and then ran it. It ran for more than 7 minutes before i gave up. I havent dug too deep into why this would not work. Any idea?
Do we have to look at ip blocks? The only thing we are looking for is difference in failed and success ip, right?

Hi @bittib010 and @best-geek thanks for highlighting these issues, we are working with the team on tracing error cause will update you shortly.

Hi @bittib010 Hi we have received a suggestion that we should compare first two parts of IPv6 also and not the entire IP, can you please check and confirm if that works as a resolution for you, thanks!

Hi @bittib010 , for security reasons, I would suggest comparing the first e sections of an IPv6 at minimum as this will be the site prefix. More information can be found here

Hi @best-geek  thanks for your updates. @bittib010 can you please confirm if this comparison resolves your issue, thanks!

Yes, in combination with the last line of code in my first message i got the most accurate data response. I also flet the query ran pretty slow. Im not sure how to proceed further. Any suggestions?

Hi @bittib010 the query is running without any delay at our end, could you check once with latest version of solution and confirm, thanks!

Gentle Reminder: We are waiting for your response on this issue. If you still need to keep this issue active, please respond on it in the next 2 days. If we don't receive response, we will be closing this issue as per our standard procedures, thanks!

Since we have not received a response in the last 5 days, we are closing your issue as per our standard operating procedures. If you still need support for this issue, feel free to re-open at any time. Thank you for your co-operation

I've been on vacation - sorry for the late reply! This looks good! Good job, and thanks!

Hi @v-vdixit , it looks like you got a reply on this issue. Could you confirm if there's still an intention to resolve this issue? We were hoping that this could be fixed by MS pushing a template so it can be updated in a scalable across a customer base and new deployments do not have this issue.

Hi @v-vdixit ,
Is there any way to re-open this issue? I had initially replied before it was closed that the fix looks good. We still haven't seen this pushed to the template.
Thanks!


Automatically select closest suitable version

Currently only exact version works (5.6.1f1 project cannot be automatically opened with 5.6.2f1 or patch releases)
Should add option to upgrade project into next compatible version, for example:
5.6.1f1 project would open in 5.6.1p1 etc.

Had a stab at this,
basic idea:

strip the letters
make a list of all available versions
add the version we want to open
order the list
find index of our version in the list
its neighbours (index-1 , index+1) are the next up and next down

(the one caveat is 2017 throws the sequential order out of whack, so i have a second function to split and test 2017s with each other, and the rest with the rest)
https://pastebin.com/uK8uF4gJ

thanks! to keep it simple, ill probably just give user your sorted list, and they can pick the version..and see if that works good enough.


fix: Irreversible Migration and Formatting

Codecov Report

Merging #28 (ce21bd9) into main (190de02) will not change coverage.
The diff coverage is 93.54%.

@@           Coverage Diff           @@
##             main      #28   +/-   ##
=======================================
  Coverage   79.57%   79.57%
=======================================
  Files          17       17
  Lines         984      984
=======================================
  Hits          783      783
  Misses        201      201

Impacted Files
Coverage Δ

...mbic/versions/20220602.13-33.add_ip_to_statuses.py
90.00% <0.00%> (ø)

webapp/models.py
91.89% <96.15%> (ø)

webapp/alembic/env.py
76.19% <100.00%> (ø)

webapp/managers.py
68.37% <100.00%> (ø)

webapp/repositories.py
88.40% <100.00%> (ø)

webapp/views.py
50.96% <100.00%> (ø)

:mega: Codecov can now indicate which changes are the most critical in Pull Requests. Learn more


Bumped codex for default configuration values

fixes https://github.com/Comcast/codex-gungnir/issues/34

Codecov Report

Merging #58 into master will not change coverage.
The diff coverage is 0%.

@@           Coverage Diff           @@
##           master      #58   +/-   ##
=======================================
  Coverage   49.05%   49.05%
=======================================
  Files           6        6
  Lines         318      318
=======================================
  Hits          156      156
  Misses        159      159
  Partials        3        3

Impacted Files
Coverage Δ

main.go
7.46% <0%> (ø)
:arrow_up:

Continue to review full report at Codecov.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update 280993f...3788e02. Read the comment docs.


chore(api): update Node.js SDK

Node: Includes manual changes to generated types:

event.data Record<string, never> -> Record<string, unknown>
meter id: make it optional

Closing due to inactivity


@kanaabe => bump text spacing down

Changes text spacing to .75em rather than 1em

👍 Feel free to merge when 🍏


current_user method not taking advantage of Rails Postgres prepared statements

Using Rails 3.2.2 with Postgres 9.1
Assuming user 1 is logged in, if I call current_user then User.find(1) two almost identical sql queries get executed.
  User Load (0.5ms)  SELECT "users".* FROM "users" WHERE "users"."id" = 1 LIMIT 1
  User Load (0.2ms)  SELECT "users".* FROM "users" WHERE "users"."id" = $1 LIMIT 1  [["id", 1]]

Shouldn't Devise take advantage of Rails prepared statements so the second finding of the user hits the sql cache?

If this is an issue, it is a Rails issue. Devise just uses Active Record's API for it, so I am unsure why prepare statements are not being used. :(


fix optomal7 told me about

@optomal7 please leave a comment explaining this change here :)
@tannerwelsh please check this out!

Without the suggested line added, the provided test is looking for something that has no possibility of existing since bike.rings = [3,7] has to first be loaded into the object before it can have the chance to calculate total speeds.

@optomal7 well, not necessarily :) If you remember from the stage two tests, new bikes have rings of [3,7] by default. (Here's the test https://github.com/GuildCrafts/oop-practice/blob/master/bike-shop/test/stage2.test.js#L84)
So this test can pass, you'd just need to make sure your constructor function includes the appropriate setup.

Instead of changing the test itself, I modified the message: https://github.com/GuildCrafts/oop-practice/commit/4b3c8f19fcd73d69fbac30512b6615633cddf4bd


Hide banner completely

Previously, the text of the banner was simply white (see PR screenshot). For now, commenting out the block will fix the issue.

Thanks to @eik-dahms for the heads up.

you could also use "display: none" css property, will also completely remove the element

looks good on https://snoopycrimecop.github.io/www.openmicroscopy.org/omero/

Thank you @eik-dahms for the report and @joshmoore for the fix. Merging.


infocusDisplaying(2) not working in iOS

Description:
When you send a notification with this code, it doesn't display any notification in the notification center when it should, as it's working perfectly on Android. This is my code:
componentWillMount(){
    OneSignal.init(settings.ONESIGNAL_API_KEY, {kOSSettingsKeyInFocusDisplayOption: 2});
    OneSignal.inFocusDisplaying(2);
  }

Notifications work fine when app is not in focus, but when app is in focus no notification gets displayed.
Also, when setting inFocusDisplaying to 0, I receive that notification in the "received" event listener always.
Environment
Onesignal 2.9.4 iOS SDK (installed with CocoaPods)
react-native-onesignal 3.2.11 (npm install and react-native link)
"react": "16.6.3",
"react-native": "0.57.8",
Steps to Reproduce Issue:

Install the OneSignal SDK using npm into your project
react-native link react-native-onesignal && cd ios && pod install
Attempt to receive a push notification with the app open

Anything else:
When the app is in focus and a notification is recieved, in the logs appear the following:
2019-01-17 22:22:45.740666+0100 tipsecapp[1205:250244] VERBOSE: onesignalUserNotificationCenter:willPresentNotification:withCompletionHandler: Fired!
2019-01-17 22:22:45.740892+0100 tipsecapp[1205:250244] VERBOSE: notificationOpened:isActive called!

And when I open the app the following logs appear:
2019-01-17 22:23:03.626620+0100 tipsecapp[1205:250244] VERBOSE: oneSignalApplicationDidBecomeActive
2019-01-17 22:23:03.626920+0100 tipsecapp[1205:250244] VERBOSE: getNotificationTypes:mSubscriptionStatus: -1
2019-01-17 22:23:03.629887+0100 tipsecapp[1205:250244] VERBOSE: getNotificationTypes:mSubscriptionStatus: -1

This issue is driving me crazy, I've tried everything I could think of and searched a lot but didn't find anything that works for me, and my whole business depends on this, please any help would be really appreciated.
Thanks for your time,
Aleix.

I'm facing the same problem in my app. Is there any solution to use both of Firebase Messaging and OneSignal in app focus ? As I guess that using Firebase Messaging to verify phone number it will push a silent message to my app could make this issue.


Have you done a benchmark comparison with same setup but using Espressif's esp_jpg_decode.c code on ESP32?

I notice Espressif has https://github.com/espressif/esp32-camera/blob/master/conversions/esp_jpg_decode.c (https://github.com/espressif/esp32-camera/blob/master/conversions/include/esp_jpg_decode.h header) which calls https://github.com/espressif/esp32-camera/blob/master/target/esp32s2/tjpgd.c for decoding.    That will help us evaluate which is better.

I did some initial testing with competing JPEG decoders (e.g. Bodmer's library) and mine averages about 50% faster. It's easy enough to set up a comparison if you're curious.


Please invite me to the GitHub Community Organization

Name
Tech Guy
Discord Username (if applicable)
beymax0605
Additional Context
I want to join to this team

I wanna join to this group

Can i join


Allowed Doc Types naming issue in grid.editors.config.js

I have two doc types whose aliases are "map" and "sitemap". In the gird.editor.config.js file, I have the following configuration:
{
    "name": "Doc Type",
    "alias": "docType",
    "view": "/App_Plugins/DocTypeGridEditor/Views/doctypegrideditor.html",
    "render": "/App_Plugins/DocTypeGridEditor/Render/DocTypeGridEditor.cshtml",
    "icon": "icon-item-arrangement",
    "config": {
      "allowedDocTypes": ["video", "titleAndDocumentList", "map", "parkNRideLocation", "wifiPasswordImage", "nestedZones"],
      "nameTemplate": "",
      "enablePreview": true,
      "viewPath": "/Views/Partials/",
      "previewViewPath": "/Views/Partials/",
      "previewCssFilePath": "",
      "previewJsFilePath": ""
    }
  }

Notice that the allowedDocTypes does not include "sitemap" however sitemap is showing up in the list of doctypes allowed in my grid. I think this is because the text "map" is part of the alias "sitemap".
Unfortunately, the only way I can currently fix is just not possible at the moment as I would have to rename the alias. This would take a lot of time to fix. Was hoping you can fix in the next update. Thanks :)

@xman51 You're right, DTGE is performing a regex match on the doctype alias, (for reference: DocTypeGridEditorApiController.cs#L29)
Our current recommendation would be to use "^map" as that regex would be explicit to match your doctype alias.

You should probably make it ^map$ to be totally explicit.
We use regex to allow things like *Widget$ style configs to automatically support doc types with a prefix without having to add them manually every time.

@leekelleher  Thank you so much. using the caret worked like a charm! :)

@xman51 aces, glad it's working. Just to add to my reply, if you do only go with ^map be aware if you had a doc type of say mapleSyrup, this would appear in the list. ^bla is essentially saying "starts with", where as ^bla$ is saying, "must be bla exactly". Just to be aware, in case you need a "mapleSyrup" doctype :D

...but let's face it, who doesn't want that "mapleSyrup" doctype?


Dude, the logo is terrible!

From<EMAIL_ADDRESS>on May 12, 2010 16:37:09
What steps will reproduce the problem? 1.Open the google page
2.Get horrified!!! What is the expected output? What do you see instead? A nice logo. It seems like the python logo is doing "service" to the guy in
the couch! @.@ Gee
Original issue: http://code.google.com/p/couchdb-python/issues/detail?id=126

This issue is still open. Is this correct? Is there anything else missing?

It's still open, but at this point it's sort of moot, since the project currently doesn't any logo anywhere. Thank you for your contributions, but I think I'll just close this.


header: center Github icon with nav items

This should fix the incorrect position of the Github icon in the header

 Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.You have signed the CLA already but the status is still pending? Let us recheck it.


SteamVR crash with Half-Life: Alyx

Description

When reloading the shotgun in Half-Life: Alyx
SteamVR will hard crash (SEGV) while the game is still running.
This issue is 100% replicable and only occurs after this commit: https://github.com/alvr-org/ALVR/commit/617b4670ee10b9e6b24642a9e454ed5fe2e290fe

Troubleshooting
Realizing that the only thing that was the same with the shotgun, was the haptic feedback.
I was able to narrow down this issue fairly easily.
I have also tried disabling haptic feedback in the settings, but it made no difference.
There wasn't much in the steamvr logs because it was a hard crash, but ALVR had this to say:
What happened: panicked at 'can not convert float seconds to Duration: value is negative', /rustc/8460ca823e8367a30dda430efda790588b8c84d3/library/core/src/time.rs:780:23 Backtrace: 0: 1: 2: 3: 4: 5: 6: 7: 8: 9: _ZN9CVRServer8RunFrameEv 10: _ZN9CVRServer3RunEv 11: _Z8RealMainjR19VRServerArguments_t 12: main 13: 14: __libc_start_main 15: _start
Let me know if you need anything else.
Environment
Hardware
Here are my pc specs: https://linux-hardware.org/?probe=29ec74ac8b
Quest 2
SteamVR Version:
1.25.7

Thank you, I take a look.

I pushed a fix, let me know it it works.

This: https://github.com/alvr-org/ALVR/commit/d2576299022307ba7fe66a8539c42f784df58322
Didn't fix the issue unfortunately.
With the exact same results and error.


Complete API reference documentation for Python

Complete the inline doc comments within the python SDK so we can publish the API reference to learn.microsoft.com

@mkarle will #2275 move this item to closure?

@matthewbolanos is this a dupe of #1985?