search

Azure / Azure-Sentinel

Cloud-native SIEM for intelligent security analytics for your entire enterprise.
https://azure.microsoft.com/en-us/services/azure-sentinel/
MIT License
4.5k stars 2.96k forks source link

could not receive logs after configuring Tenable.io Vulnerability Management (Preview) #5174

Closed IDCheryl closed 1 year ago

IDCheryl commented 2 years ago

Describe the bug After creating Tenableio in Content hub, then deployed ARM for Data connector: Tenable.io Vulnerability Management (Preview) waiting more than 48hours, no data could be received

To Reproduce Steps to reproduce the behavior:

  1. Go to 'Content hub' >> search Tenable, create Tenable solution
  2. Click on 'Data connector' >> search "Tenable.io Vulnerability Management (Preview)" >> choose Azure Resource Manager (ARM) Template to deploy function app with workspace ID& key and TenableAccessKey and TenableSecretKey
  3. After waiting 48hours, go to logs and query "Tenable_IO_Assets_CL"
  4. See error

  5. image

Expected behavior Logs should be received after configuring data connector

Screenshots If applicable, add screenshots to help explain your problem. image

github-actions[bot] commented 2 years ago

Thank you for submitting an Issue to the Azure Sentinel GitHub repo! You should expect an initial response to your Issue from the team within 5 business days. Note that this response may be delayed during holiday periods. For urgent, production-affecting issues please raise a support ticket via the Azure Portal.

dneto82 commented 2 years ago

@IDCheryl did you ran parser after deployed solution?

IDCheryl commented 2 years ago

Hello @dneto82 , I have not yet ran parser. I'm trying to query Tenable_IO_Assets_CL this original data type, no data returned. Below is the error message I found, could you please suggest what the problem and how can i address it? error

IDCheryl commented 2 years ago

Hello @dneto82

Tenant permission has been updated to administrator now, and i could observe the Tenable_IO_Assets_CL logs now.

However I could still not observe any Tenable_IO_Vulns_CL logs. I have checked the function app. Success timestamp already exists.

Error message attached. vul

and I've seen someone commented for this solution as well, I've encounter just the same issue here. comments

i could see the assest data ingested but no vuln data. Please kindly help fix

github-actions[bot] commented 1 year ago

Thank you for submitting an Issue to the Azure Sentinel GitHub repo! You should expect an initial response to your Issue from the team within 5 business days. Note that this response may be delayed during holiday periods. For urgent, production-affecting issues please raise a support ticket via the Azure Portal.

github-actions[bot] commented 1 year ago

Thank you for submitting an Issue to the Azure Sentinel GitHub repo! You should expect an initial response to your Issue from the team within 5 business days. Note that this response may be delayed during holiday periods. For urgent, production-affecting issues please raise a support ticket via the Azure Portal.

v-amolpatil commented 1 year ago

Hi @IDCheryl, thank you for flagging this. Apologies for the delayed response. If you still need assistance, please reply here within 5 business days.

v-amolpatil commented 1 year ago

Since we have not received a response in the last 5 days, we are closing your issue #5174 as per our standard operating procedures. If you still need support for this issue, feel free to re-open at any time. Thank you for your co-operation.

github-actions[bot] commented 1 year ago

Thank you for submitting an Issue to the Azure Sentinel GitHub repo! You should expect an initial response to your Issue from the team within 5 business days. Note that this response may be delayed during holiday periods. For urgent, production-affecting issues please raise a support ticket via the Azure Portal.