You’re offline. This is a read only version of the page.
Announcements
Hello everyone,
I hope this is the right place to post something like this, but if it's not, please point me in the right direction.
The Proofpoint TAP connector which is currently in preview uses a function app with a powershell script that runs every 5 minutes. The script makes a request to the proofpoint API and gets the alerts from the last 5 minutes. This usually works great, but we noticed that sometimes the request to the proofpoint API fails (with either 502 or 504), but the script continues running and says that there are no new logs when in reality there could be new logs that were not fetched due to the failed api call. The next time the function is run, the api call usually works, but it only brings the last 5 minutes of logs which means the logs that occurred between 10 and 5 min before (when the call failed) will never be fetched leaving us with a blind spot in sentinel.
I think that the script should check sentinel when the last successful fetch was made and use the proofpoint API to bring that period of logs instead of just a rigid 5 minutes interval. This would ensure the coverage even when the API fails sometime.
Share
Report
All responses (
Answers (
525
