Azure-Sentinel
Azure-Sentinel copied to clipboard
Azure
CrowdstrikeFalconAPISentinelConnector is ignoring secondary events
Describe the bug CrowdstrikeFalconAPISentinelConnector is ignoring the secondary events that it pulls from the SQS URL
To Reproduce Steps to reproduce the behavior:
- Enable the integration between CrowdStrike and Sentinel using the ContentHub
- Input all the necessary fields
- Go to the function app in Azure
- See the Monitor
Expected behavior All the Events should be in Sentinel not just the raw events from the data file
Screenshots
Desktop (please complete the following information):
- OS: MacOS
- Browser: Chrome
Thank you for submitting an Issue to the Azure Sentinel GitHub repo! You should expect an initial response to your Issue from the team within 5 business days. Note that this response may be delayed during holiday periods. For urgent, production-affecting issues please raise a support ticket via the Azure Portal.
![github-actions[bot] avatar](https://avatars.githubusercontent.com/in/15368?v=4 "Published by a pub.dev verified publisher"){kind=small}
Maybe it's because the Logsource has more than 500 properties, that is just a speculation
Thank you for submitting an Issue to the Azure Sentinel GitHub repo! You should expect an initial response to your Issue from the team within 5 business days. Note that this response may be delayed during holiday periods. For urgent, production-affecting issues please raise a support ticket via the Azure Portal.
Thank you for submitting an Issue to the Azure Sentinel GitHub repo! You should expect an initial response to your Issue from the team within 5 business days. Note that this response may be delayed during holiday periods. For urgent, production-affecting issues please raise a support ticket via the Azure Portal.
Thank you for submitting an Issue to the Azure Sentinel GitHub repo! You should expect an initial response to your Issue from the team within 5 business days. Note that this response may be delayed during holiday periods. For urgent, production-affecting issues please raise a support ticket via the Azure Portal.
@ZLT-ops : This seems to be a very old problem, and this connector may have already had numerous updates, can you please check if your problem has been solved? Thanks!!
@ZLT-ops As per previous comment closing this issue. Feel free to reopen the issue if you need more assistance. Thanks!
Thank you for submitting an Issue to the Azure Sentinel GitHub repo! You should expect an initial response to your Issue from the team within 5 business days. Note that this response may be delayed during holiday periods. For urgent, production-affecting issues please raise a support ticket via the Azure Portal.