Forum Discussion
Microsoft Sentinel Query History not updating
Hello,
Apologies if this isn't the correct place for this but I know I will likely retire before I get any traction with Microsoft support.
Has anyone experienced issues with their Sentinel Query History not updating with the latest queries? I run a lot of queries each day and any time I open a new browser window and go to the logs tab, the latest query it shows in my history is 7/29/2025. If I run any new queries in that browser tab, they show in my query history but the moment I open a new browser tab and access sentinel logs, they are gone and it shows the latest query as 7/29/2025. My colleague has the exact same issue except their latest query date is 8/7/2025... Yes I do have the "Save query history" setting set to On. I have toggled it of and back on just to see if it would do anything but no luck. Does anyone know what could be causing this?
6 Replies
I'm facing the same issue as well. Last query stored was from 07/30/2025
Hey CJ3207 ,
checked a couple tenants and I'm not seeing the same behavior you're seeing. Wondering if it might be a browser caching issue? I would try clearing it or using a different browser.
I know you're not asking for alternatives but just in case and maybe for future reference, if you're using the Unified SecOps (XDR) dashboard for querying (Advanced Hunting), there's a report you can look at to get your query history. Not only does it log the query but you can also get an idea of how performant your queries are: Use the advanced hunting query resource report - Microsoft Defender XDR | Microsoft Learn
Alternatively, you could also start ingesting your queries so you always have 'em in their own table within Sentinel: Audit queries in Azure Monitor log queries - Azure Monitor | Microsoft Learn
Best regards,
Dylan
Hello,
Are there any updates on this?Hey Dylan,
Thanks for the reply. To your recommendation to clearing the cache, I have tried that. I also did mention that "My colleague has the exact same issue" further evidence supporting that its not local as they are in a different office, on a different machine, using a different browser. While searching for solutions, I did come across the "LAQueryLogs" and do have that set up now. But that is not an ideal solution. Like Shawn_j in the comments below, I also extensively rely on my query history for things like quick reference to particular functions or assisting with building and modifying my queries before I save them. I really would like a fix to this issue as soon as possible. Any other ideas as to what could be causing this?Hey Dylan,
Thanks for the reply. To your recommendation to clearing the cache, I have tried that. I also did mention that "My colleague has the exact same issue" further evidence supporting that its not local as they are in a different office, on a different machine, using a different browser. While searching for solutions, I did come across the "LAQueryLogs" and do have that set up now. But that is not an ideal solution. Like Shawn_j in the comments below, I also extensively rely on my query history for things like quick reference to particular functions or assisting with building and modifying my queries before I save them. I really would like a fix to this issue as soon as possible. Any other ideas as to what could be causing this?
I am having the exact same issue. My last queries are from 7/29/25. I use query history extensively and this is really annoying. Hello Microsoft?
