Hello, I am trying to figure out why the Entra error code "50074" is not coming from the sourcetype="o365:graph:api" insisted i am seeing the sourcetype= "o365:management:activity".  I checked on the azure side and the AuditLog.Read.All has been granted admin consent. The only one that does not have admin consent is Directory.ReadAll. Could that be the issue or am i missing anything ? ... View more

Hello, Today we were upgraded to ES 8 but we don't see the option to print investigations anymore. Is that still an option ? Maybe it was moved and i am not able to find it. Printing investigations is an important part of our process.  ... View more

Hello, I have created a new role but i noticed that the users who i have assigned that role get an "error occurred while rendering the page template" When they click the fields option under knowledge. I looked at the capabilities but cant seem to find the right one that provides access to fields.      ... View more