Forum Discussion

TheriumSec's avatar
TheriumSec
Copper Contributor
Jun 12, 2020

Odd Field mapping behavour

Hello All -   Wondering if anyone else has/is encountering some odd behavior with log indexing to uncommon fields? Recently we discovered when we we doing queries in Sentinel/Log Analytics Workspac...
Ofer_Shezaf's avatar
Ofer_Shezaf
Icon for Microsoft rankMicrosoft
Jun 14, 2020

Hi TheriumSec,

 

This was a system issue. The issue has been resolved and data should consistently appear in the documented fields.

 

~ Ofer

TheriumSec's avatar
TheriumSec
Copper Contributor
Jun 17, 2020

Hi Ofer_Shezaf 

 

Thank you for your insight into this issue. We are now seeing the data mapping to the proper fields, however the newly created fields such as UserId_, ClientIP_, OrganizationId_, etc. are all still being populated as well. Also when this occurred it caused historical data to be misrepresented in unsupported fields and not even written to in the supported fields, that has not been fixed. Is anyone else noticing this specific to Office 365 logs in Sentinel? 

Resources