All Apps and Add-ons

Windows Defender ATP Modular Inputs TA not ingesting new data

New Member

I have Windows Defender ATP Modular Inputs TA installed on a heavy forwarder. Initially got some data ingested but after sometime no new data has been coming in and I see error in logs saying duplicate event hence execution getting skipped. This has been happening for many days now. Microsoft confirmed there is new data available to ingest. @thambisetty Could you please help. Is this normal and need to be fixed by Microsoft?

4/30/20
8:42:32.766 AM

2020-04-30 08:42:32,766 INFO pid=18777 tid=MainThread file=base_modinput.py:log_info:293 | Exiting..End of the script
4/30/20
8:42:32.766 AM

2020-04-30 08:42:32,766 DEBUG pid=18777 tid=MainThread file=base_modinput.py:log_debug:286 | Duplicate event found. skipping...
4/30/20
8:42:32.766 AM

2020-04-30 08:42:32,766 DEBUG pid=18777 tid=MainThread file=binding.py:new_f:71 | Operation took 0:00:00.002918
4/30/20
8:42:32.765 AM

2020-04-30 08:42:32,765 DEBUG pid=18777 tid=MainThread file=connectionpool.py:_make_request:387 | "GET /servicesNS/nobody/TA_windows-defender/storage/collections/data/TA_windows_defender_checkpointer/thre_obj_checkpoint HTTP/1.1" 200 114
4/30/20
8:42:32.763 AM

2020-04-30 08:42:32,763 DEBUG pid=18777 tid=MainThread file=binding.py:get:664 | GET request to https://127.0.0.1:8089/servicesNS/nobody/TA_windows-defender/storage/collections/data/TA_windows_def... (body: {})
4/30/20
8:42:32.760 AM

2020-04-30 08:42:32,760 DEBUG pid=18777 tid=MainThread file=connectionpool.py:_make_request:400 | https://wdatp-alertexporter-us.securitycenter.windows.com:443 "GET //api/alerts?sinceTimeUtc=2020-04-30%2000:28:14.600626 HTTP/1.1" 200 2208

0 Karma

Champion

can you please check if you see any new events in defender console after the last event received in Splunk?

TA uses field "LastProcessedTimeUtc" to get new results. 

————————————
If this helps, give a like below.
0 Karma