Run into Error 429: RateLimit in Large Environment

Đang mở
#65 1 bình luận 0 reaction 0 người được giao Xem trên GitHub

Chưa có ai nhận issue này.

Đánh giá

Độ khó
4/5
Thời gian dự kiến
3-5 ngày
Mức phù hợp với người mới
30/100
Loại issue
Lỗi
Độ rõ ràng
Cần làm rõ
Mức độ hoạt động
Đình trệ
Công nghệ
azure, go
Lĩnh vực
api, cloud

Hướng nghiên cứu

No source files or tests are identified. Start by reproducing the AzureHound v2.1.5 collection in a large environment and correlate the collection stages with the 429 entries in the GraphActivity logs; done should be defined as a complete collection without the reported rate-limit failures.

Do mô hình lập chỉ mục viết ra từ nội dung của issue.

Mô tả

Azurehound Version: 2.1.5

users count=416092

Azurehound throws some errors, but continues to run. When looking into the GraphActivity logs, I can see that a lot of 429-errors are generated.
Example Ouptut from Azurehound (IDs redacted for privacy):

AzureHound v2.1.5
Created by the BloodHound Enterprise team - https://bloodhoundenterprise.io

No configuration file located at C:\Windows\system32\config\systemprofile\.config\azurehound\config.json
No configuration file located at C:\Windows\system32\config\systemprofile\.config\azurehound\config.json
2023-11-17T07:35:48Z INF collecting azure objects...
2023-11-17T07:35:48Z INF finished listing all tenants count=2
2023-11-17T07:35:49Z INF finished listing all roles count=106
2023-11-17T07:35:50Z INF finished listing all role assignments
2023-11-17T07:35:50Z INF finished listing all management groups count=66
2023-11-17T07:35:50Z INF finished listing all management group role assignments
2023-11-17T07:35:51Z INF finished listing all management group descendants
2023-11-17T07:36:00Z ERR unable to continue processing logic apps for this subscription error="json: cannot unmarshal string into Go struct field Recurrence.value.properties.definition.triggers.recurrence.interval of type int" subscriptionId=26*******0b
2023-11-17T07:36:01Z INF finished listing all subscriptions count=128
2023-11-17T07:36:01Z ERR unable to continue processing virtual machines for this subscription error="map[error:map[code:DisallowedOperation message:The current subscription type is not permitted to perform operations on any provider namespace. Please use a different subscription.]]" subscriptionId= 9f********bb
2023-11-17T07:36:01Z ERR unable to continue processing logic apps for this subscription error="map[error:map[code:DisallowedOperation message:The current subscription type is not permitted to perform operations on any provider namespace. Please use a different subscription.]]" subscriptionId= 9f********bb
2023-11-17T07:36:01Z ERR unable to continue processing key vaults for this subscription error="map[error:map[code:DisallowedOperation message:The current subscription type is not permitted to perform operations on any provider namespace. Please use a different subscription.]]" subscriptionId= 9f********bb
2023-11-17T07:36:01Z ERR unable to continue processing managed clusters for this subscription error="map[error:map[code:DisallowedOperation message:The current subscription type is not permitted to perform operations on any provider namespace. Please use a different subscription.]]" subscriptionId= 9f********bb
2023-11-17T07:36:01Z ERR unable to continue processing key vaults for this subscription error="map[error:map[code:DisallowedOperation message:The current subscription type is not permitted to perform operations on any provider namespace. Please use a different subscription.]]" subscriptionId=52*******40
2023-11-17T07:36:01Z ERR unable to continue processing container registries for this subscription error="map[error:map[code:DisallowedOperation message:The current subscription type is not permitted to perform operations on any provider namespace. Please use a different subscription.]]" subscriptionId=52*******40
2023-11-17T07:36:01Z ERR unable to continue processing virtual machines for this subscription error="map[error:map[code:DisallowedOperation message:The current subscription type is not permitted to perform operations on any provider namespace. Please use a different subscription.]]" subscriptionId=52*******40
2023-11-17T07:36:01Z ERR unable to continue processing automation accounts for this subscription error="map[error:map[code:DisallowedOperation message:The current subscription type is not permitted to perform operations on any provider namespace. Please use a different subscription.]]" subscriptionId= 9f********bb
2023-11-17T07:36:01Z ERR unable to continue processing function apps for this subscription error="map[error:map[code:DisallowedOperation message:The current subscription type is not permitted to perform operations on any provider namespace. Please use a different subscription.]]" subscriptionId= 9f********bb
2023-11-17T07:36:01Z ERR unable to continue processing virtual machine scale sets for this subscription error="map[error:map[code:DisallowedOperation message:The current subscription type is not permitted to perform operations on any provider namespace. Please use a different subscription.]]" subscriptionId= 9f********bb
2023-11-17T07:36:01Z ERR unable to continue processing web apps for this subscription error="map[error:map[code:DisallowedOperation message:The current subscription type is not permitted to perform operations on any provider namespace. Please use a different subscription.]]" subscriptionId= 9f********bb
2023-11-17T07:36:01Z ERR unable to continue processing role assignments for this subscription error="map[error:map[code:DisallowedOperation message:The current subscription type is not permitted to perform operations on any provider namespace. Please use a different subscription.]]" subscriptionId=/subscriptions/ 9f********bb
2023-11-17T07:36:01Z ERR unable to continue processing container registries for this subscription error="map[error:map[code:DisallowedOperation message:The current subscription type is not permitted to perform operations on any provider namespace. Please use a different subscription.]]" subscriptionId= 9f********bb
2023-11-17T07:36:01Z ERR unable to continue processing role assignments for this subscription error="map[error:map[code:DisallowedOperation message:The current subscription type is not permitted to perform operations on any provider namespace. Please use a different subscription.]]" subscriptionId=/subscriptions/52*******40
2023-11-17T07:36:01Z ERR unable to continue processing managed clusters for this subscription error="map[error:map[code:DisallowedOperation message:The current subscription type is not permitted to perform operations on any provider namespace. Please use a different subscription.]]" subscriptionId=29***********45
2023-11-17T07:36:01Z ERR unable to continue processing logic apps for this subscription error="map[error:map[code:DisallowedOperation message:The current subscription type is not permitted to perform operations on any provider namespace. Please use a different subscription.]]" subscriptionId=52*******40
2023-11-17T07:36:01Z ERR unable to continue processing function apps for this subscription error="map[error:map[code:DisallowedOperation message:The current subscription type is not permitted to perform operations on any provider namespace. Please use a different subscription.]]" subscriptionId=52*******40
2023-11-17T07:36:01Z ERR unable to continue processing automation accounts for this subscription error="map[error:map[code:DisallowedOperation message:The current subscription type is not permitted to perform operations on any provider namespace. Please use a different subscription.]]" subscriptionId=52*******40
2023-11-17T07:36:01Z ERR unable to continue processing automation accounts for this subscription error="map[error:map[code:DisallowedOperation message:The current subscription type is not permitted to perform operations on any provider namespace. Please use a different subscription.]]" subscriptionId=29***********45
2023-11-17T07:36:01Z INF finished listing all automation accounts
2023-11-17T07:36:01Z ERR unable to continue processing web apps for this subscription error="map[error:map[code:DisallowedOperation message:The current subscription type is not permitted to perform operations on any provider namespace. Please use a different subscription.]]" subscriptionId=52*******40
2023-11-17T07:36:01Z ERR unable to continue processing managed clusters for this subscription error="map[error:map[code:DisallowedOperation message:The current subscription type is not permitted to perform operations on any provider namespace. Please use a different subscription.]]" subscriptionId=52*******40
2023-11-17T07:36:01Z INF finished listing all managed clusters
2023-11-17T07:36:01Z INF finished listing all automation account role assignments
2023-11-17T07:36:01Z INF finished listing all managed cluster role assignments
2023-11-17T07:36:01Z ERR unable to continue processing virtual machines for this subscription error="map[error:map[code:DisallowedOperation message:The current subscription type is not permitted to perform operations on any provider namespace. Please use a different subscription.]]" subscriptionId=29***********45
2023-11-17T07:36:01Z ERR unable to continue processing key vaults for this subscription error="map[error:map[code:DisallowedOperation message:The current subscription type is not permitted to perform operations on any provider namespace. Please use a different subscription.]]" subscriptionId=29***********45
2023-11-17T07:36:01Z ERR unable to continue processing logic apps for this subscription error="map[error:map[code:DisallowedOperation message:The current subscription type is not permitted to perform operations on any provider namespace. Please use a different subscription.]]" subscriptionId=29***********45
2023-11-17T07:36:01Z INF finished listing all logic apps
2023-11-17T07:36:01Z ERR unable to continue processing virtual machine scale sets for this subscription error="map[error:map[code:DisallowedOperation message:The current subscription type is not permitted to perform operations on any provider namespace. Please use a different subscription.]]" subscriptionId=52*******40
2023-11-17T07:36:01Z ERR unable to continue processing function apps for this subscription error="map[error:map[code:DisallowedOperation message:The current subscription type is not permitted to perform operations on any provider namespace. Please use a different subscription.]]" subscriptionId=29***********45
2023-11-17T07:36:01Z INF finished listing all function apps
2023-11-17T07:36:01Z ERR unable to continue processing role assignments for this subscription error="map[error:map[code:DisallowedOperation message:The current subscription type is not permitted to perform operations on any provider namespace. Please use a different subscription.]]" subscriptionId=/subscriptions/29***********45
2023-11-17T07:36:01Z INF finished listing all subscription role assignments
2023-11-17T07:36:01Z ERR unable to continue processing virtual machine scale sets for this subscription error="map[error:map[code:DisallowedOperation message:The current subscription type is not permitted to perform operations on any provider namespace. Please use a different subscription.]]" subscriptionId=29***********45
2023-11-17T07:36:01Z INF finished listing all virtual machine scale sets
2023-11-17T07:36:01Z ERR unable to continue processing container registries for this subscription error="map[error:map[code:DisallowedOperation message:The current subscription type is not permitted to perform operations on any provider namespace. Please use a different subscription.]]" subscriptionId=29***********45
2023-11-17T07:36:01Z ERR unable to continue processing web apps for this subscription error="map[error:map[code:DisallowedOperation message:The current subscription type is not permitted to perform operations on any provider namespace. Please use a different subscription.]]" subscriptionId=29***********45
2023-11-17T07:36:01Z INF finished listing all web apps
2023-11-17T07:36:01Z INF finished listing all function app role assignments
2023-11-17T07:36:01Z INF finished listing all subscription user access admins
2023-11-17T07:36:01Z INF finished listing all vm scale set role assignments
2023-11-17T07:36:01Z INF finished listing all web app role assignments
2023-11-17T07:36:01Z INF finished listing all logic app role assignments
2023-11-17T07:36:03Z INF finished listing all resource groups
2023-11-17T07:36:03Z INF finished listing all resource group role assignments
2023-11-17T07:36:05Z INF finished listing all apps count=2154
2023-11-17T07:36:05Z INF finished listing all app owners
2023-11-17T07:36:17Z INF finished listing all key vaults
2023-11-17T07:36:17Z INF finished listing all key vault role assignments
2023-11-17T07:36:19Z INF finished listing all virtual machines
2023-11-17T07:36:19Z INF finished listing all virtual machine role assignments
2023-11-17T07:36:30Z INF finished listing all container registries
2023-11-17T07:36:30Z INF finished listing all container registry role assignments
2023-11-17T07:36:52Z ERR unable to continue processing members for this group error="unable to complete the request after 3 attempts: %!w(<nil>)" groupId=f0************6a
2023-11-17T07:36:52Z ERR unable to continue processing owners for this group error="unable to complete the request after 3 attempts: %!w(<nil>)" groupId=3d************33
2023-11-17T07:36:52Z ERR unable to continue processing owners for this group error="unable to complete the request after 3 attempts: %!w(<nil>)" groupId=27************f2
2023-11-17T07:36:52Z ERR unable to continue processing owners for this group error="unable to complete the request after 3 attempts: %!w(<nil>)" groupId=7c************16
2023-11-17T07:36:52Z ERR unable to continue processing owners for this group error="unable to complete the request after 3 attempts: %!w(<nil>)" groupId=74************d6
2023-11-17T07:36:53Z ERR unable to continue processing members for this group error="unable to complete the request after 3 attempts: %!w(<nil>)" groupId=03************0d
2023-11-17T07:36:53Z ERR unable to continue processing owners for this device error="unable to complete the request after 3 attempts: %!w(<nil>)" deviceId=0b************c4
2023-11-17T07:36:54Z ERR unable to continue processing owners for this device error="unable to complete the request after 3 attempts: %!w(<nil>)" deviceId=0b************94
2023-11-17T07:38:37Z INF finished listing all service principals count=9913
2023-11-17T07:38:37Z INF finished listing all app role assignments
2023-11-17T07:38:38Z INF finished listing all service principal owners
2023-11-17T07:42:48Z INF finished listing all users count=416092
Ngôn ngữ chính
Go
Star
982
Fork
152
Merge trung bình
1 giờ 45 phút
Pull request đã merge (30 ngày)
1

Chuẩn bị môi trường

  • Có Dockerfile hoặc tệp Docker Compose
  • Không có mẫu pull request
  • Không có hướng dẫn đóng góp

Bắt đầu từ đâu

  1. Đọc hết issue, rồi đọc hướng dẫn đóng góp của dự án.
  2. Bình luận trên issue rằng bạn sẽ nhận — tránh hai người làm cùng một việc.
  3. Fork repository và làm thay đổi trên một nhánh.
  4. Mở pull request có tham chiếu số hiệu của issue.

Issue khác của SpecterOps/AzureHound

Tất cả issue của SpecterOps/AzureHound

Issue tương tự

Thêm issue về Go

Nhận issue mới trong hộp thư của bạn

Bản tóm tắt ngắn những issue GitHub phù hợp với người mới.