Azure-Sentinel icon indicating copy to clipboard operation
Azure-Sentinel copied to clipboard

Azure AD Sign-in logs' Sign-ins by Location not working for large amounts of data

Open Lodewyk-Git opened this issue 4 years ago • 12 comments

Describe the bug The Sign-ins by Location query looks fine to me, it works when I run it separately in a LAW, but for some reason it's not working correctly in the workbook. All other queries are working correctly.

To Reproduce Steps to reproduce the behavior:

  1. Go to 'Azure AD Sign-in logs'
  2. Have almost 1M sign-ins
  3. Scroll down to 'Sign-ins by Location'
  4. See error

Expected behavior Correct values as shown in LAW

Screenshots Sign-In Workbook

Lodewyk-Git avatar Sep 21 '21 09:09 Lodewyk-Git

Thank you for submitting an Issue to the Azure Sentinel GitHub repo! You should expect an initial response to your Issue from the team within 5 business days. Note that this response may be delayed during holiday periods. For urgent, production-affecting issues please raise a support ticket via the Azure Portal.

github-actions[bot] avatar Sep 21 '21 09:09 github-actions[bot]

Thank you for submitting an Issue to the Azure Sentinel GitHub repo! You should expect an initial response to your Issue from the team within 5 business days. Note that this response may be delayed during holiday periods. For urgent, production-affecting issues please raise a support ticket via the Azure Portal.

github-actions[bot] avatar Sep 22 '21 17:09 github-actions[bot]

Thank you for submitting an Issue to the Azure Sentinel GitHub repo! You should expect an initial response to your Issue from the team within 5 business days. Note that this response may be delayed during holiday periods. For urgent, production-affecting issues please raise a support ticket via the Azure Portal.

github-actions[bot] avatar Sep 28 '21 06:09 github-actions[bot]

Thank you for submitting an Issue to the Azure Sentinel GitHub repo! You should expect an initial response to your Issue from the team within 5 business days. Note that this response may be delayed during holiday periods. For urgent, production-affecting issues please raise a support ticket via the Azure Portal.

github-actions[bot] avatar Sep 28 '21 06:09 github-actions[bot]

Thank you for submitting an Issue to the Azure Sentinel GitHub repo! You should expect an initial response to your Issue from the team within 5 business days. Note that this response may be delayed during holiday periods. For urgent, production-affecting issues please raise a support ticket via the Azure Portal.

github-actions[bot] avatar Sep 28 '21 16:09 github-actions[bot]

Thank you for submitting an Issue to the Azure Sentinel GitHub repo! You should expect an initial response to your Issue from the team within 5 business days. Note that this response may be delayed during holiday periods. For urgent, production-affecting issues please raise a support ticket via the Azure Portal.

github-actions[bot] avatar Sep 28 '21 17:09 github-actions[bot]

Thank you for submitting an Issue to the Azure Sentinel GitHub repo! You should expect an initial response to your Issue from the team within 5 business days. Note that this response may be delayed during holiday periods. For urgent, production-affecting issues please raise a support ticket via the Azure Portal.

github-actions[bot] avatar Sep 28 '21 17:09 github-actions[bot]

@nazang - Is it possible to please look into this? Thanks.

preetikr avatar Sep 28 '21 17:09 preetikr

Seeing this same problem across multiple (10+) workspaces

image

Lodewyk-Git avatar Oct 01 '21 12:10 Lodewyk-Git

@nazang - Is it possible to please look into this? Thanks.

v-laanjana avatar Oct 25 '22 06:10 v-laanjana

Thank you for submitting an Issue to the Azure Sentinel GitHub repo! You should expect an initial response to your Issue from the team within 5 business days. Note that this response may be delayed during holiday periods. For urgent, production-affecting issues please raise a support ticket via the Azure Portal.

github-actions[bot] avatar Jan 10 '23 13:01 github-actions[bot]

Thank you for submitting an Issue to the Azure Sentinel GitHub repo! You should expect an initial response to your Issue from the team within 5 business days. Note that this response may be delayed during holiday periods. For urgent, production-affecting issues please raise a support ticket via the Azure Portal.

github-actions[bot] avatar Jan 10 '23 13:01 github-actions[bot]

Hi @Lodewyk-Git , thank you for flagging this. Apologies for the delayed response. If you still need assistance, please reply here within 5 business days.

v-amolpatil avatar Feb 08 '23 16:02 v-amolpatil

Gentle Reminder: We are awaiting for your response on this issue. If you still need to keep this issue active please respond within next 2 days. If we don't receive response by 16 Feb 2023, we will close this issue.

v-amolpatil avatar Feb 14 '23 05:02 v-amolpatil

Since we have not received a response in the last 5 days, we are closing your issue #3086 as per our standard operating procedures. If you still need support for this issue, feel free to re-open at any time. Thank you for your co-operation.

v-amolpatil avatar Feb 16 '23 18:02 v-amolpatil

Thank you for submitting an Issue to the Azure Sentinel GitHub repo! You should expect an initial response to your Issue from the team within 5 business days. Note that this response may be delayed during holiday periods. For urgent, production-affecting issues please raise a support ticket via the Azure Portal.

github-actions[bot] avatar Feb 16 '23 18:02 github-actions[bot]