# O365 authentication details shows up after 2 hr in kibana

**URL:** <https://discuss.elastic.co/t/o365-authentication-details-shows-up-after-2-hr-in-kibana/305062>\
**Category:** Kibana\
**Created:** [May 18, 2022, 12:18pm UTC](https://discuss.elastic.co/t/o365-authentication-details-shows-up-after-2-hr-in-kibana/305062 "2022-05-18T12:18:22Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![niveditakathal](https://avatars.discourse-cdn.com/v4/letter/n/e19b73/32.png) [@niveditakathal](https://discuss.elastic.co/u/niveditakathal)\
**Post date:** [May 18, 2022, 12:18pm UTC](https://discuss.elastic.co/t/o365-authentication-details-shows-up-after-2-hr-in-kibana/305062/1 "2022-05-18T12:18:22Z")

</div>

Hi Experts,

I added the O365 integration in elastic 8.2 with all default Content types enabled to monitor the successful/failure login details ; However when I was testing the possible test cases, I noticed that If I login to O365 with invalid login details, then it reflected after 2 hr in elastic.

Test case with output -

- _Add filters - data\_stream.dataset: o365.audit with last 15 min_ =\> **returns hits / data**
- _Add filter - data\_stream.dataset: o365.audit , event.category: authentication with last 15 min_ =\> **returns no hits / no data**
- _Add filter - data\_stream.dataset: o365.audit , event.category: authentication with last 2 hours_ =\> **returns hits / data**

Can someone please assist me on , how I can get the invalid login details at the real time ?

Thanks in advance !  
Regards,  
Nivedita

---

<div class="post-metadata">

**Author:** ![legoguy1000](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/legoguy1000/32/54301_2.png) [@legoguy1000](https://discuss.elastic.co/u/legoguy1000)\
**Post date:** [May 18, 2022, 12:27pm UTC](https://discuss.elastic.co/t/o365-authentication-details-shows-up-after-2-hr-in-kibana/305062/2 "2022-05-18T12:27:35Z")

</div>

The only thing I can think of is ur time/timezone is off on ur computer/browser. Is the timestamp on the event correct?

---

<div class="post-metadata">

**Author:** ![niveditakathal](https://avatars.discourse-cdn.com/v4/letter/n/e19b73/32.png) [@niveditakathal](https://discuss.elastic.co/u/niveditakathal)\
**Post date:** [May 18, 2022, 12:47pm UTC](https://discuss.elastic.co/t/o365-authentication-details-shows-up-after-2-hr-in-kibana/305062/3 "2022-05-18T12:47:58Z")

</div>

Thanks for the reply.  
Timestamp on the event is correct. (i.e if I login with wrong credentials at 10:45 AM , then after 2 hours, I can see an event in elastic with timestamp as 10:45 with UserLoginFailed).

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/2/a/2a07079d57afb93ff7ccc2c5d43dcadcce899030.png)

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [June 15, 2022, 12:48pm UTC](https://discuss.elastic.co/t/o365-authentication-details-shows-up-after-2-hr-in-kibana/305062/4 "2022-06-15T12:48:39Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.