Users are missing some URLClickEvents data in the advanced hunting tab of the Microsoft Defender portal

Title: Users are missing some URLClickEvents data in the advanced hunting tab of the Microsoft Defender portal
User impact: Users are missing some URLClickEvents data in the advanced hunting tab of the Microsoft Defender portal.
More info: Specifically, URLClickEvents data gathered during the period from November 6, 2023 until the offending change was reverted on November 11th wasn’t processed as expected, resulting in that data not being visible through the advanced hunting tab.
Current status: We’ve successfully reverted the offending change throughout the affected environment, and we’re now re-processing the affected event data for the period of impact. We’re anticipating the affected data will be fully restored by our next scheduled communications update. This process may result in some duplicate URLClickEvents appearing; affected users can manually remove these duplicates from query results using a distinct on the ‘ReportId’ value.
Scope of impact: This issue may affect any user attempting to view URLClickEvent data in the advanced hunting tab of the Microsoft Defender portal.
Start time: Monday, November 6, 2023, at 8:00 AM UTC
Root cause: A recent change to an uploader service component leveraged for event processing and reading from advanced hunting contained a configuration issue resulting in impact.
Next update by: Thursday, November 16, 2023, at 2:30 AM UTC

Comments

No comments yet. Why don’t you start the discussion?

Leave a Reply

Your email address will not be published. Required fields are marked *