Microsoft Entra Suite Tech Accelerator
Aug 14 2024, 07:00 AM - 09:30 AM (PDT)
Microsoft Tech Community

Manual IOC import stuck in status 'In Progress'

Copper Contributor

TJSentinel_0-1706891609053.png

A couple of days ago I populated a copy of the File data IOC template with some sha-256 hashes, and while doing so using Excel, accidently bumped my [PgDn] keyboard button and zoomed down about 10000 rows or so.
I duly utilized the right slider bar to zoom back up to the top of the worksheet, finished adding hashes, timestamps and indicator types (the three minimum required fields) and then commenced the import process.

 

My Sentinel instance imported the handful of IOC's but shows 1048565 invalid records out of 1048574 and is stuck in 'In Progress' status.  Rt-clicking on the entry shows the Delete option but it's grayed out, so Sentinel won't allow me to select it. 

TJSentinel_1-1706892222505.png


Has anyone encountered similar behavior and found a way to stop and remove a seemingly stuck import process?

1 Reply

@TJSentinel You may have to restart Sentinel and try again (sans the additional rows). Clearly the failure load is too big for the error handling mechanism Sentinel has in place. Sentinel will hang on to any error files (and actual files) for about 24 hours. Also, remember that the max file size for an import is 50MB. Hope this helps.