Forum Discussion
Playbook is not running
Hi Team, Please help me to resolve this issue. We have created one playbook for outbound traffic to ThreatIntel. But after sometime it is giving blank excel sheet. Before it provide 2-3 times result...
I take it you are trying to do a union with 5 different Microsoft Sentinel instances? Those unions are not cheap in terms of processing and will take a long to time run since you are getting all the information and then doing a filter. I would suggest filtering the data on each union command so that only the information you need is actually being sent with the union command.
- may you re write my query ?so i can understand easily and i will apply to get result
- As you dont summarize the results returned, you could be getting 100-30k rows per workspace, that takes time and isn't easily human readable.
Maybe reduce the results using a bin or arg_max (you may in the investigation have to get the specific time range) but for the Alert this should be good enough to get focus on the rough time and details.
e.g. Add one of these lines
..
| where Computer !in (deviceIP)
| extend CommonSecurityLog_TimeGenerated = TimeGenerated
// use this
| summarize count(), make_set(SourceIP) by Computer, DeviceAction, bin(CommonSecurityLog_TimeGenerated,1d)
//or maybe this
//| summarize count(), make_set(SourceIP), arg_max(CommonSecurityLog_TimeGenerated, Computer) by DeviceAction- where we hv to add these line because expression getting failed
