Recent Logic Apps Failures with Defender ATP Steps – "TimeGenerated" No Longer Recognized

Something happened the week of May 21, 2025, because I'm having inconsistent results from queries myself where this particular week can only either be the beginning or end of all data returned. You may want to double check that the results you're seeing in the Advanced Hunting UI are accurate because mine are absolutely not.

The culprit is indeed the TimeGenerated field, but more specifically inconsistent results arise from using any custom date range traversing the week of May 21, using either TimeGenerated with ago() or the UI calendar dropdown. If you limit the query window to one of the presets in the UI (hourly/7/30/day), only then does the query work as expected.

This warrants a ticket being opened with Microsoft, but some other sucker can volunteer for that. Never again.