Forum Discussion

Francesco47's avatar
Francesco47
Copper Contributor
Mar 06, 2020

Azure Sentinel Hunting Livestream

Hello Community,

we are working on a custom Hunting Query based on a failed login by expired account in Azure Sentinel. The Query runs properly but when we try to add it to livestream, we noticed that the query pauses by itself after some time. 

 

 

 

In Microsoft Docs we found that the query added to livestream is supposed to run until it is stopped intentionally. Could you please tell us how to solve this issue? 

Thank you for your support!

  • Rod_Trent's avatar
    Rod_Trent
    Icon for Microsoft rankMicrosoft
    Mar 06, 2020

    Francesco47 Could you post the query so we can take a look at it to make sure there's no thresholds built into it? 

     

    Additionally, the Live Stream session will continue unless you sign out of the Azure portal. So, an active Azure portal session is also required. 

Resources