topic Re: E86.70 and Newer & Threat Hunting in Endpoint

E86.70 and Newer & Threat Hunting

Swiftyyyy — Fri, 16 Dec 2022 13:01:46 GMT

Hello CheckMates,

We've been fairly actively testing versions E86.70 & Newer due to their added support for 22H2 (albeit still EA).
We had recently noticed an issue relating to Threat Hunting; we only have records for "Detection Event" and "Network" sensor categories and even in those departments, the numbers are significantly lower than what we'd typically see in prior versions.

And this is consistent among ~300 installations of these newer clients.

Within our statistics pool, E86.60 still appears to function as expected in regards to Threat Hunting delivery. A check was also performed with "checkconnectivity.exe" and on E86.80, which is our largest sample size, the 3 URLs associated with Threat Hunting Upload all appear to fail.

We've upgraded a handful of clients to E87.00 and the connectivity check now appears to succeed, but we're still not receiving events to TH, though the sample size here is still fairly small.

Is anyone else experiencing this?

Re: E86.70 and Newer & Threat Hunting

_Val_ — Mon, 19 Dec 2022 12:37:35 GMT

R&D is investigating, this is not only your isolated issues. We will update you once we have more information.

Re: E86.70 and Newer & Threat Hunting

Swiftyyyy — Tue, 20 Dec 2022 08:21:08 GMT

Looks to have been corrected.
I opened a case with TAC yesterday, today I wanted to collect a set of logs for them & noticed things are working again.
So I'm confirming that E86.70, E86.80 as well as E87.00 in the sample sizes we have appear to be forwarding TH events again.

Re: E86.70 and Newer & Threat Hunting

_Val_ — Tue, 20 Dec 2022 09:49:43 GMT

Thanks for letting us know.

Re: E86.70 and Newer & Threat Hunting

Shiran_Gold — Tue, 20 Dec 2022 11:23:23 GMT

Hi,

Following your feedback and others we have investigated the behavior and made a change in the backend side to resolve the issue.

I am happy to hear you are getting the expected data correctly.

Have a nice day

Shiran