From 0a5a1c8c9c04649584a949223860df9a97e9283d Mon Sep 17 00:00:00 2001
From: Adon Metcalfe <adon.metcalfe@dpc.wa.gov.au>
Date: Thu, 30 Mar 2023 15:24:45 +0800
Subject: [PATCH] Update api.py

Patch to handle dead subscriptions
---
 siem_query_utils/api.py | 28 ++++++++++++++++------------
 1 file changed, 16 insertions(+), 12 deletions(-)

diff --git a/siem_query_utils/api.py b/siem_query_utils/api.py
index e9640fe..033c964 100755
--- a/siem_query_utils/api.py
+++ b/siem_query_utils/api.py
@@ -200,18 +200,22 @@ def workspace_details():
     for wsdata in list_workspaces("json"):
         customerId = wsdata["customerId"]
         sub = wsdata["subscription"]
-        ws = azcli(
-            [
-                "monitor",
-                "log-analytics",
-                "workspace",
-                "list",
-                "--subscription",
-                sub,
-                "--query",
-                f"[?customerId == '{customerId}']",
-            ]
-        )[0]
+        try: # handle dead/missing subscriptions
+            ws = azcli(
+                [
+                    "monitor",
+                    "log-analytics",
+                    "workspace",
+                    "list",
+                    "--subscription",
+                    sub,
+                    "--query",
+                    f"[?customerId == '{customerId}']",
+                ]
+            )[0]
+        except Exception as exc:
+            logger.warning(exc)
+            continue
         ws["id"] = ws["id"].lower()
         ws["name"] = ws["name"].lower()
         ws["ingest_function"] = f"{ws['customerId'].replace('-', '_')}_incoming"