Office 365 connector

[Skipster]

Hello

I am able to connect Azure AD to Sentinel and i can see audit and log in data from Azure AD, however i am not getting any data from O365. I can connect O365 to Azure Sentinel but i dont see any data. When i look at the template i get the below error message . I have already tired deleting the O365 workbook and disconnecting the connector, and reconnecting it, but i still run into the same issue

"This query could not run because some parameters are not set.
Please set: Workload, UserType"

[#2]

@Skipster The error is referring to the parameters drop down at the top of the workbook.  There is a TimeRange, Workload, and UserType drop down and all three will need to be set.

[#3]

@Gary BusheyHi Gary

I dont have those options. See screen shot

[#4]

@Skipster They are the two drop downs that have the red dot next to them

[#5]

@Gary BusheyUnderstood, however there is nothing to select in the drop down. It just says query failed

[#6]

@Skipster OK, now I get it.   Those drop downs are looking for the "OfficeActivity" table which brings you back to your original statement about not having the data.  Sorry for all the confusion.

BTW, deleting the workbook won't really do anything, it is the connector that is needed.  You said you have it connected and it states it is connected.  When you click on the Office 365 data connector, in the details pane on the right side, is there anything listed in the Data Received graph?

[#7]

@Gary BusheyHi Gary. No, no data is listed in the "Data revived" pane

[#8]

@Skipster At this point you may need to open a ticket with MS to figure out what is going on.