I have Windows Defender ATP Modular Inputs TA installed on a heavy forwarder. Initially got some data ingested but after sometime no new data has been coming in and I see error in logs saying duplicate event hence execution getting skipped. This has been happening for many days now. Microsoft confirmed there is new data available to ingest. @thambisetty Could you please help. Is this normal and need to be fixed by Microsoft?
4/30/20
8:42:32.766 AM
2020-04-30 08:42:32,766 INFO pid=18777 tid=MainThread file=base_modinput.py:log_info:293 | Exiting..End of the script
4/30/20
8:42:32.766 AM
2020-04-30 08:42:32,766 DEBUG pid=18777 tid=MainThread file=base_modinput.py:log_debug:286 | Duplicate event found. skipping...
4/30/20
8:42:32.766 AM
2020-04-30 08:42:32,766 DEBUG pid=18777 tid=MainThread file=binding.py:new_f:71 | Operation took 0:00:00.002918
4/30/20
8:42:32.765 AM
2020-04-30 08:42:32,765 DEBUG pid=18777 tid=MainThread file=connectionpool.py:_make_request:387 | "GET /servicesNS/nobody/TA_windows-defender/storage/collections/data/TA_windows_defender_checkpointer/thre_obj_checkpoint HTTP/1.1" 200 114
4/30/20
8:42:32.763 AM
2020-04-30 08:42:32,763 DEBUG pid=18777 tid=MainThread file=binding.py:get:664 | GET request to https://127.0.0.1:8089/servicesNS/nobody/TA_windows-defender/storage/collections/data/TA_windows_def... (body: {})
4/30/20
8:42:32.760 AM
2020-04-30 08:42:32,760 DEBUG pid=18777 tid=MainThread file=connectionpool.py:_make_request:400 | https://wdatp-alertexporter-us.securitycenter.windows.com:443 "GET //api/alerts?sinceTimeUtc=2020-04-30%2000:28:14.600626 HTTP/1.1" 200 2208
