Microsoft Sentinel
A scalable, cloud-native solution for security information event management and security orchestration automated response. Previously known as Azure Sentinel.
1,210 questions
Custom rule triggered but need to refresh event query multiple times to get results
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(252.8, 20%, 34%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EMW%3C/text%3E%3C/svg%3E)
Mariana Wolter
1
Reputation point
I have a custom rule that is triggered when one or more identical entities are mapped due a certain time, and it works always, but sometimes when I click in the events, I don't see results and I have to refresh a couple of times to see the data. Any idea why this could be?
Example of incident generated:
When clicking the events, nothing is shown:
If I click run multiple times (in this example I did it 5 times) I get the result:
Good request details:
Bad request details:
{count} votes
-
JamesTran-MSFT 36,776 Reputation points Microsoft Employee2021-02-05T23:42:54.09+00:00 @Anonymous
Thank you for the detailed post!Based off your issue, it looks like everything is working as expected besides the fact that you have to run your query multiple times.
- Has this been happening more frequently after you noticed this the first time? Or is this causing further issues within your environment?
- Was anything changed that could have cause your query to not return results?
- Have you tried troubleshooting this issue?
If you have any other questions, please let me know.
Thank you for your time and patience throughout this issue. -
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(195.2, 0%, 28%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EVM%3C/text%3E%3C/svg%3E)
VipulSparsh-MSFT 16,291 Reputation points Microsoft Employee2021-02-26T14:17:40.447+00:00 I just wanted to check in and see if you had any other questions or if you were able to resolve this issue?
If you have any other questions, please let me know.
Thank you for your time and patience throughout this issue.----------
Please remember to "Accept Answer" if any answer/reply helped, so that others in the community facing similar issues can easily find the solution.
-
Mariana Wolter 1 Reputation point
2021-02-28T19:31:08.523+00:00 This happened with the 18% of the resulting incidents I opened, from 2 different custom rules. Nothing changed in between.
What troubleshooting you suggest to do?Thanks.
-
Mariana Wolter 1 Reputation point
2021-02-28T19:40:54.313+00:00 Is not solved, last event I see having this issue is from a week ago, with a different rule.
Sign in to comment
Sign in to answer