Forum Discussion

BrianAndersen's avatar
BrianAndersen
Copper Contributor
Feb 23, 2024

Duplicate Events in IdentityLogonEvents table

We have been experiencing "duplicate" events in the IdentityLogonEvents Table since 2024-02-14.

 

The only difference i can see in the events are that the Application field in one event is "Active Directory" and in the other event it's "Microsoft Active Directory".

 

Also the ReportId fiels is different between the two, in the sense that the event with "Microsoft Active Directory" appends a string to the ReportId.

 

Is there a way to avoid this duplication of the events?

Or what is the reason for this?

 

Running Azure Advanced Threat Protection Sensor version 2.230.17681.9355.

1 Reply

  • BrianAndersen's avatar
    BrianAndersen
    Copper Contributor

    The logs with Application name "Microsoft Active Directory" has disappeared from our IdentityLogonEvents table.

     

    So we have no duplicate logs anymore.