Delay in office logs

[mrosendo]

Hi everyone,

We just integrated Office 365 and we followed the steps describen in the integration. The API is showing that requests from Azure are ok, but the logs in Kibana comes like with 7 days of delay, so we don't know if this is a configuration from Azure, did anyone have experienced that? I attached and image with the logs that we are receiving.

[willemdh]

Hello,

Fyi, we have a little latency, like 15 minutes or so. 7 days seems not right. Is this with the Elastic Agent integration or the FIlebeat module?

WillemD

[mrosendo]

Yes that's why we are confused, we have another cluster with the same but the logs come in real time. This is with an Elastic Agent, we are using the Microsoft 365 Integration.

So maybe someone has experienced this before, maybe it's not related with Elastic, insted is Microsoft.

[guessWho (Curtis Paulson)]

Barring any issues with your API, this could be the one Microsoft thing that I've seen over the years. Microsoft does not guarantee timely delivery of logs to their API. I've seen logs come in a year late before just because that's when whatever goes on with their backend finally coughed up the logs to the API. I've seen many people think they are going to get Microsoft to fix this by opening tickets with them; has yet to change in the years I've been in security and looking at Microsoft logs every day.