SentinelOneAPISentinelConn.zip modification caused existing Function Apps to stop working

[q0njg3m1]

Describe the bug
https://raw.githubusercontent.com/Azure/Azure-Sentinel/refs/heads/master/Solutions/SentinelOne/Data%20Connectors/SentinelOneAPISentinelConn.zip modification from yesterday (2024-10-23) caused existing SentinelOneSentinelConnector function in the Function App to fail with the following error:

Result: Failure Exception: ImportError: libffi-9c61262e.so.8.1.0: cannot open shared object file: No such file or directory. Cannot find module. Please check the requirements.txt file for the missing module. For more info, please refer the troubleshooting guide: https://aka.ms/functions-modulenotfound. Current sys.path: ['/tmp/functions\standby\wwwroot', '/home/site/wwwroot/.python_packages/lib/site-packages', '/azure-functions-host/workers/python/3.8/LINUX/X64', '/usr/local/lib/python38.zip', '/usr/local/lib/python3.8', '/usr/local/lib/python3.8/lib-dynload', '/usr/local/lib/python3.8/site-packages'] Stack: File "/azure-functions-host/workers/python/3.8/LINUX/X64/azure_functions_worker/dispatcher.py", line 535, in _handle__function_load_request func = loader.load_function( File "/azure-functions-host/workers/python/3.8/LINUX/X64/azure_functions_worker/utils/wrappers.py", line 49, in call raise extend_exception_message(e, message) File "/azure-functions-host/workers/python/3.8/LINUX/X64/azure_functions_worker/utils/wrappers.py", line 44, in call return func(*args, **kwargs) File "/azure-functions-host/workers/python/3.8/LINUX/X64/azure_functions_worker/loader.py", line 220, in load_function mod = importlib.import_module(fullmodname) File "/usr/local/lib/python3.8/importlib/init.py", line 127, in import_module return _bootstrap._gcd_import(name[level:], package, level) File "", line 1014, in _gcd_import File "", line 991, in _find_and_load File "", line 975, in _find_and_load_unlocked File "", line 671, in _load_unlocked File "", line 843, in exec_module File "", line 219, in _call_with_frames_removed File "/home/site/wwwroot/SentinelOneSentinelConnector/init.py", line 11, in from .state_manager import StateManager File "/home/site/wwwroot/SentinelOneSentinelConnector/state_manager.py", line 1, in from azure.storage.fileshare import ShareClient File "/home/site/wwwroot/.python_packages/lib/site-packages/azure/storage/fileshare/init.py", line 8, in from ._file_client import ShareFileClient File "/home/site/wwwroot/.python_packages/lib/site-packages/azure/storage/fileshare/_file_client.py", line 28, in from ._shared.uploads import IterStreamer, FileChunkUploader, upload_data_chunks File "/home/site/wwwroot/.python_packages/lib/site-packages/azure/storage/fileshare/_shared/uploads.py", line 21, in from .encryption import get_blob_encryptor_and_padder File "/home/site/wwwroot/.python_packages/lib/site-packages/azure/storage/fileshare/_shared/encryption.py", line 19, in from cryptography.hazmat.primitives.padding import PKCS7 File "/home/site/wwwroot/.python_packages/lib/site-packages/cryptography/hazmat/primitives/padding.py", line 11, in from cryptography.hazmat.bindings._padding import lib

We have two Function Apps, deployed from the SentinelOne Data Connector via the ARM Template option more than 6 months ago, that stopped working since yesterday, both of them with the same error.
In the current SentinelOneAPISentinelConn.zip file there is a .python_packages\lib\site-packages\cffi.libs\libffi-806b1a9d.so.6.0.4 file but the filename is different than the one from the error: libffi-9c61262e.so.8.1.0.

The https://aka.ms/sentinel-SentinelOneAPI-functionapp URL in the Function App WEBSITE_RUN_FROM_PACKAGE environment variable redirects to this URL:
https://raw.githubusercontent.com/Azure/Azure-Sentinel/refs/heads/master/Solutions/SentinelOne/Data%20Connectors/SentinelOneAPISentinelConn.zip

The file SentinelOneAPISentinelConn.zip shows to have been modified yesterday (2024-10-23) at the same time our two Function Apps stopped working.

[decturau]

I have the same issue. Stopped working after the update..

[q0njg3m1]

Just fixed it. Make sure you have the SentinelOne Solution updated to the latest version. Create a new Function App from the "SentinelOne (using Azure Functions)" Data Connector using the same settings as the old one. The new one should work ok.

[decturau]

That worked for me too! Updated the solution and redeployed the function. Thanks!

[q0njg3m1]

Glad it worked!