Forum Discussion

ronakshah's avatar
ronakshah
Copper Contributor
Mar 26, 2020

Azure Sentinel Workbook Displays Old Data Due To Caching

I have created a KQL and using that plotted a Tile view in the workbook. The data in the Tile is supposed to change based on the Timerange filter I have added. This is working fine unless new events are received. So let's say I have selected "Last 24 hours" at 12 PM and the count in tile is "2". Now I keep the session idle for a few minutes and at 12:10 PM, a new event arrives. Thereafter when I change the Timerange filter to "Last 5 minutes", I see the new event, but when I again change the Timerange filter to "Last 24 hours", the count still will be "2" instead of "3". 

However, when I refresh the entire web page, the count will be updated. Is there any way to overcome this? I think the results are being cached by Azure and reused, but is there a way to disable this?

KQL
  • Rod_Trent's avatar
    Rod_Trent
    Icon for Microsoft rankMicrosoft
    Mar 26, 2020

    ronakshah Have you tested to make sure it's not the web browser caching the content? Try running the Workbook in an inPrivate Window to test.

    • ronakshah's avatar
      ronakshah
      Copper Contributor
      Mar 27, 2020

      Rod_Trent 

       

      Yes, I tried and the issue seems to be with browser cache, but shouldn't that be handled in some way by Azure Platform as with this user will not be able to see the latest events?

      • Rod_Trent's avatar
        Rod_Trent
        Icon for Microsoft rankMicrosoft
        Mar 27, 2020

        ronakshah Can I ask which browser you are using? 

         

        Some browsers, due to additional plugins (and other factors) can be pretty aggressive with local cache to provide a faster web experience. Those should be configurable.

Resources