TiIndicators not showing up in ThreatIntelligenceIndicator Logs

[JBUB_Arbala]

It seems that around July 2nd, 7/2/2020, 9:17:26.272 PM UTC, all of our custom TiIndicators stopped showing up in our 

ThreatIntelligenceIndicator logs. All of the logic apps are running successfully and POSTing to the SecGraphApi - with the correct responses. We can also send a GET to the API with the newly created TiIndicator ID and verify that the indicator exists. When searching the logs we are not seeing anything, however.

The indicators retrieved by the built in TAXII data connector are still in the logs.

We have tested this with the standard POST method the to API as well as the new MS Graph Security -  Create TiIndicator/Create Multiple TiIndicator actions in the LogicApps. We have also tested in a separate tenant.   

[#2]

@JBUB_Arbala 

Not sure who put this fix in, but we are seeing positive results now in both tenants. Nothing changed on our end. Any post-fix info would be great. Thanks again MS Sentinel Team!

[#3]

@JBUB_Arbala : While we monitor for issues and try to preempt, I do recommend opening a support ticket in such a case. Whether instead of or in addition to a community post. While the community interaction is lively and quite fast, if something disrupts your service, we want to make sure we resolve it as soon as possible.

[#4]

@Ofer_Shezaf Thank you Ofer =)

We have opened a ticket and I can confirm it is broken again. 3 separate tenants and the last threat intel entry that shows up in the logs is on the 10th. The logic apps run and I can return threat intel, but it's just not in the logs for use in analytic rules. 

I encourage others to check their logs and make sure their rules are working. Or at least be aware log entries are missing.  

[#5]

@JBUB_Arbala - Can you please send me the link to the support ticket? We would need the Tenant ID and Workspace ID in order to investigate the issue further. 

[#6]

@JBUB_Arbala 

We are experiencing the same issues . I have logged a MS support ticket. Waiting for themfind resolution.

[#7]

@MalliBoppe - Can you please provide the support ticket link? We would need  the workspace id and tenant id to further investigate the issue.

[#8]

This issue should now be resolved. Please let me know if you still see the issue persisting. 

[#9]

Thank you! We received notice yesterday that there was an ongoing issue. I will update in a few days.

[#10]

@JBUB_Arbala 

We experienced the same issue and on the same date. I already opened a support ticket with microsoft support. But they haven't yet identified that there was an issue

[#11]

@majo01 : The issue is now resolved. Are you still seeing the issue persisting? 

Please make sure that the TIP Connector in Sentinel is turned on.

[#12]

@RijutaKapoorThe  ticket number is 120070623000858

[#13]

@RijutaKapoor 

We are still seeing this issue.  It works for a few days then breaks again. I have attached an image with our baseline. You can see when the issue starts to ramp up and then totally stop.

[#14]

@JBUB_Arbala  - Can you please confirm if the TIP Connector is enabled for you? Are you also using the TAXII Data connector? 

[#15]

@JBUB_Arbala  - Also, can we get on a quick call to investigate and explain the issue?

[#16]

@RijutaKapoor Yes, we have TIP and TAXII enabled. Among many other sources. I can send you my number in messages.

[#17]

@JBUB_Arbala -That would really help. My email is "rikapoo@microsoft.com". Please drop me an email and I will schedule a call with you sometime this we...

[#18]

@RijutaKapoor  I think the issue has been resolved now. I was told by teh MS engineer that the issue impacted the Australia region.

[#19]

@MalliBoppe - Yes the issue was affecting Australian customers and now it has been resolved.