Advanced Hunting Opens Briefly, then goes blank

[Brok3NSpear]

Hi,

I have an issue in Advanced Hunting where the portal will open up briefly, but then go blank.

This has been happening since Wednesday for me and raised a ticket (#‎2405090050000419) with Microsoft for this on Thursday AM, but have yet to get a response and just sits at, 'A support agent is being assigned to your request'.

I have tried accessing the AH area in Private Mode, via Chrome (Edge is my main browser) and clearing cache, but still no joy. I also disabled Dark Mode to see if that was the issue, as I know that Dark Mode does cause visibility issues in the XDR portal (especially when attempting to preview emails when investigating emails)

This has also been noted by a user on Twitter 

This isn't affecting other users in my tenant (based in UK) as they are still able to access the AH area without issue.

We also haven't yet enabled the Unified SIEM/XDR as yet, so that isn't the issue. If if it was, the issue is still only affecting my account, and no one else who has access to that area.

Should be noted that they rarely use AH, so wouldn't have as many previously open AH tabs as I normally always do. I believe that I had approx. 10 or so tabs open for various queries I was looking up or creating.

I am still able to access the Custom Detection Rules section which sits underneath that link without issue.

This means that I am completely unable to run any AH queries currently, which is an issue.

[#2]

@Brok3NSpear 

My advanced hunting also ends up at a blank screen. It broke sometime around the 8th or 9th. It starts to load and i can see my previous queries and within a few seconds it turns into an empty page.  I was thinking it may be due to the amount of open query tabs(12+) that i had open but i have not found a way to reset the layout.

[#3]

@MBStallion 

Same issue for me as well as my coworker.

[#4]

@Brok3NSpear Any update on this issue? I'm getting reports of the same issue at my corp. also. No Advisories reported by MSFT as of yet. Thanks.

[#5]

None yet I'm afraid. We have a 3 day (working) SLA with MS, so I will be pushing from tomorrow.

Normally they are pretty quick and I can jump on a Teams call with them to explain and show then the exact issue. If I do manage to get assistance on this and a fix, I will reply here so it may help others.

[#6]

Thanks for the update. I've opened a Premium ticket through our E5. I've also notified our Internal Contact at Microsoft. I'll update once I get any new info for this group.

[#7]

@DMBisME 

Still nothing back from support I'm afraid, but I have also noticed the latest Intel Report is also showing up as blank as well. All other previous reports are fine.

Was trying to read the Vulnerability Profile: CVE-2024-30051 - Desktop Window Manager EoP vulnerability via Threat Intelligence>Threat Analytics

Adding to the post as it may be related, or just a MS issue

[#8]

@Brok3NSpear 

We've started our investigation with MSFT and they have begun asking for logs and such. As of right now it doesn't seem they have an RC for this issue. I'll keep you posted with anything new that I find. Thanks for checking in and updating your side. 

[#9]

I have same issue with the Advanced Hunting page being blank since some time last week, please share any resolution from Microsoft.

[#10]

@Brok3NSpear 

I had the same issue and was able to fix it. My screen looked exactly like yours; it would show for a split second then go blank. 

My fix: I throttled my Internet so the webpage took longer to load, then I loaded the webpage on a device that has a touch screen. Between the throttled Internet and using the touch screen to quickly tap the X on the query tabs that were open, I was able to close one tab before the screen went blank. I repeated that 3 times (closing 3 tabs total) and then the webpage started loading properly. I closed all of the remaining tabs just in case. There were 5 query tabs open in total.

Side note, I went into the Dev tools while the issue was happening, and every time I tried to load the Advanced Hunting page, I saw errors related to KQL syntax in the Dev console.

[#11]

@DMBisME 

As of this morning (07:40hrs UK time) this seems to now open without issue.

MS did not get in contact on the ticket, so this wasn't a support fix. I am guessing that they have had engineers start to look in to this as it now opens fine.

I have 10 or so tabs open, and since closed them all out and re-opened the page again to check.

Hope yours gets resolved shortly as well. Am keeping the ticket open for 24hrs just to make sure that it doesn't revert and will then close out with them.