`azure.subscription.cloudDefender.settingsSentinel` missing field `properties`

[mm-weber]

Describe the bug

cnspec> azure.subscription.cloudDefender.settingsSentinel {*}
azure.subscription.cloudDefender.settingsSentinel: {
  name: "Sentinel"
  id: "/subscriptions/<subscription>providers/Microsoft.Security/settings/Sentinel"
  kind: "AlertSyncSettings"
  type: "Microsoft.Security/settings"
}

Should also return the properties field with the sub-field enabled:

az account get-access-token --query "{subscription:subscription,accessToken:accessToken}" --out tsv | xargs -L1 bash -c 'curl -X GET -H "Authorization: Bearer $1" -H "Content-Type:application/json" https://management.azure.com/subscriptions/<subscription>/providers/Microsoft.Security/settings?api-version=2021-06-01' | jq '.|.value[] '

{
  "id": "/subscriptions/<subscription>/providers/Microsoft.Security/settings/MCAS",
  "name": "MCAS",
  "type": "Microsoft.Security/settings",
  "kind": "DataExportSettings",
  "properties": {
    "enabled": true
  }
}

The same goes for WDATP and Sentinel.

To Reproduce
A seen above run the commands.

Expected behavior
The cnspec command also need to include the field below for MCAS,WDATP,Sentinel.

  "properties": {
    "enabled": true
  }

Screenshots or CLI Output
If applicable, add screenshots or the CLI output to help explain your problem.

Desktop (please complete the following information):

azure 11.3.42

[syrull]

This seems to be fixed per: #5203

cnquery> azure.subscription.cloudDefender.settingsWDATP
azure.subscription.cloudDefender.settingsWDATP: azure.subscription.cloudDefenderService.settings name="WDATP" kind="DataExportSettings"
cnquery>
cnquery> azure.subscription.cloudDefender.settingsWDATP { * }
azure.subscription.cloudDefender.settingsWDATP: {
  type: "Microsoft.Security/settings"
  id: "/subscriptions/e9ee8090-9784-42d6-9534-bc1d881eeff6/providers/Microsoft.Security/settings/WDATP"
  name: "WDATP"
  kind: "DataExportSettings"
}
cnquery> azure.subscription.cloudDefender.settingsSentinel
azure.subscription.cloudDefender.settingsSentinel: azure.subscription.cloudDefenderService.settings name="Sentinel" kind="AlertSyncSettings"
cnquery> azure.subscription.cloudDefender.settingsSentinel { * }
azure.subscription.cloudDefender.settingsSentinel: {
  name: "Sentinel"
  id: "/subscriptions/e9ee8090-9784-42d6-9534-bc1d881eeff6/providers/Microsoft.Security/settings/Sentinel"
  kind: "AlertSyncSettings"
  type: "Microsoft.Security/settings"
}
cnquery> azure.subscription.cloudDefender.settingsMCAS { * }
azure.subscription.cloudDefender.settingsMCAS: {
  name: "MCAS"
  type: "Microsoft.Security/settings"
  kind: "DataExportSettings"
  id: "/subscriptions/e9ee8090-9784-42d6-9534-bc1d881eeff6/providers/Microsoft.Security/settings/MCAS"
}

[syrull]

Okay, I didn't understand at first but now I see that properties is missing my bad.

[syrull]

In the getSecuritySettingsFor there is a missing response.SettingClassification to set the kind of security setting. The right one to be used is *armsecurity.DataExportSettings. Hence with the missing of this type assertion we are falling for the default setting object which does not contain the properties.

Here is the right one:

settings, ok := response.SettingClassification.(*armsecurity.DataExportSettings)

[syrull]

fix: #5415