07-07-2020 04:38 PM
07-07-2020 04:38 PM
It seems that around July 2nd, 7/2/2020, 9:17:26.272 PM UTC, all of our custom TiIndicators stopped showing up in our
07-07-2020 11:01 PM
Not sure who put this fix in, but we are seeing positive results now in both tenants. Nothing changed on our end. Any post-fix info would be great. Thanks again MS Sentinel Team!
07-12-2020 10:38 AM
@JBUB_Arbala : While we monitor for issues and try to preempt, I do recommend opening a support ticket in such a case. Whether instead of or in addition to a community post. While the community interaction is lively and quite fast, if something disrupts your service, we want to make sure we resolve it as soon as possible.
07-14-2020 01:22 PM
@Ofer_Shezaf Thank you Ofer =)
We have opened a ticket and I can confirm it is broken again. 3 separate tenants and the last threat intel entry that shows up in the logs is on the 10th. The logic apps run and I can return threat intel, but it's just not in the logs for use in analytic rules.
I encourage others to check their logs and make sure their rules are working. Or at least be aware log entries are missing.
07-15-2020 02:44 PM
@JBUB_Arbala - Can you please send me the link to the support ticket? We would need the Tenant ID and Workspace ID in order to investigate the issue further.
07-15-2020 04:57 PM
We are experiencing the same issues . I have logged a MS support ticket. Waiting for themfind resolution.
07-16-2020 08:33 AM
@MalliBoppe - Can you please provide the support ticket link? We would need the workspace id and tenant id to further investigate the issue.
07-21-2020 01:36 PM
This issue should now be resolved. Please let me know if you still see the issue persisting.
07-21-2020 02:03 PM
07-22-2020 02:37 AM
We experienced the same issue and on the same date. I already opened a support ticket with microsoft support. But they haven't yet identified that there was an issue
07-22-2020 08:08 AM
@majo01 : The issue is now resolved. Are you still seeing the issue persisting?
Please make sure that the TIP Connector in Sentinel is turned on.
07-27-2020 06:52 PM
We are still seeing this issue. It works for a few days then breaks again. I have attached an image with our baseline. You can see when the issue starts to ramp up and then totally stop.
07-28-2020 10:14 AM
@JBUB_Arbala - Can you please confirm if the TIP Connector is enabled for you? Are you also using the TAXII Data connector?
07-28-2020 02:10 PM
@JBUB_Arbala - Also, can we get on a quick call to investigate and explain the issue?
07-28-2020 02:20 PM
@RijutaKapoor Yes, we have TIP and TAXII enabled. Among many other sources. I can send you my number in messages.
07-28-2020 02:34 PM
@JBUB_Arbala -That would really help. My email is "firstname.lastname@example.org". Please drop me an email and I will schedule a call with you sometime this we...
07-28-2020 10:28 PM
@RijutaKapoor I think the issue has been resolved now. I was told by teh MS engineer that the issue impacted the Australia region.
07-29-2020 06:11 PM
@MalliBoppe - Yes the issue was affecting Australian customers and now it has been resolved.