search

counteractive / o365beat

Elastic Beat for fetching and shipping Office 365 audit events
Other
66 stars 27 forks source link

Incorrect system time can lead to failed requests #22

Closed chris-counteractive closed 4 years ago

chris-counteractive commented 4 years ago

The beat relies on the system time to calculate the spans for which it queries the API. If the system time is wrong in a particular way, it can cause the beat to ask the API for content outside the span of the allowed 7 day window, which kicks out errors.

Not sure this is a bug with the beat, but might be worth creating an error or warning if the system time and "API time" are different (or different enough). Consider pulling the current time from a source that matches the API (or the API itself?) and doing the datetime arithmetic using that.

chris-counteractive commented 4 years ago

We haven't received any additional reports of this issue, and a time-check adds complexity for what is an out-of-beat issue. Closing for now, will reconsider if there's significant demand.