Troubleshooting - Microsoft EntraID

If you use the RFI-lookup-and-save-user playbook to Lookup leaks info for an email and response lookup data is empty (for specified email and look back range) - the playbook will still save empty results to the Log Analytics Custom Log.

This case is possible if you set up the Playbooks in that way that Lookup look back range (lookup_lookback_days) in RFI-lookup-and-save-user playbook is smaller than Search look back range (search_lookback_days) in RFI-search-workforce-user or RFI-search-external-user playbooks.

In that case you will see some empty records in the corresponding Log Analytics Custom Log (see the screenshot).

entra-troubleshoot1.png

Another way to cover this case - you can add a corresponding check to RFI-lookup-and-save-user playbook and not save the results to Log Analytics if the result is empty.

This content is confidential. Do not distribute or download content in a manner that violates your Recorded Future license agreement. Sharing this content outside of licensed Recorded Future users constitutes a breach of the terms and/or agreement and shall be considered a breach by your organization.
Was this article helpful?
0 out of 0 found this helpful

Articles in this section

See more