topic Output stop working in General Topics

Output stop working

RogerMoquin — Fri, 16 Aug 2019 13:33:13 GMT

I have a Output to Azure Sentinel. I reboot, it work then stop working for a unknown reason. I have a bunch of ERROR.SUBMIT

How do I troubleshoot that ?

Re: Output stop working

lmori — Fri, 16 Aug 2019 13:39:48 GMT

Are the error.submit increasing? if not, it could have been a transient error on the API side.

For details check the minemeld-engine.log file: System > Engine > Logs

Luigi

Re: Output stop working

RogerMoquin — Fri, 16 Aug 2019 17:09:37 GMT

I am getting this error. I have validated and this indicatorID is present in Sentinel. MineMeld tries many time to query the same ID. I think it doesn't move to the next IOC until the error is cleared, which never happen

2019-08-16T13:55:41 (100542)node._push_loop ERROR: AzureSentinelV3 - error submitting indicators - 400 Client Error: Bad Request for url: https://graph.microsoft.com/beta/security/tiIndicators/9F7A051D71B8052134AAAFC52AF541B4253C2DA4A7C78DFE5F5CFAF84C85EC4D

Re: Output stop working

lmori — Mon, 19 Aug 2019 14:54:44 GMT

@fvigo could you take a look?

Re: Output stop working

fvigo — Mon, 19 Aug 2019 17:43:17 GMT

Hi @RogerMoquin , what version of the Extension are you using? We fixed a similar issue on version 0.2, that was released two weeks ago.

Thanks,

Francesco