Defender for Endpoint Device Timeline for servers onboarded from Azure Defender

Mikko K 6 Reputation points
2021-09-24T06:25:50.32+00:00

I have onboarded a bunch of Windows Server 2019 and Linux virtual machines to Azure Defender and then enabled the Defender for Endpoint (MDE) integration.

Every other MDE feature works just fine in the MDE portal, but for some reason Device Timeline does not work.

For every server Timeline gives the following error: "Error loading items 500 [object Object] [object Object] [object XMLHttpRequest]".

This is a MDE tenant with no other devices, it's only used for the servers and it was created when I enabled the Azure Defender integration.

Microsoft Defender for Cloud
Microsoft Defender for Cloud
An Azure service that provides threat protection for workloads running in Azure, on-premises, and in other clouds. Previously known as Azure Security Center and Azure Defender.
1,193 questions
0 comments

2 answers

Sort by: Most helpful
Most helpful Newest Oldest
  1. VipulSparsh-MSFT 16,231 Reputation points Microsoft Employee
    2021-09-24T07:23:25.353+00:00

    @Mikko K Thanks for reaching out.

    Its probably the huge amount of data your servers are generating which is causing this exception, In my test environment, every Server loads up well and does contains lots of data even when that server is not doing anything. : For example :

    134956-image.png

    As a test, can you select the timelines just for 30 minutes and try to see if they load up (considering 30 mins will contain less data) :
    134957-image.png

    -----------------------------------------------------------------------------------------------------------------

    Please remember to "Accept Answer" if any answer/reply helped, so that others in the community facing similar issues can easily find the solution.

    0 comments
  2. Mikko K 6 Reputation points
    2021-09-24T07:32:56.197+00:00

    Thanks @VipulSparsh-MSFT ,

    Good idea to try, but unfortunately there is no change.

    Also the servers are not production so there should be relatively small amount of data for now... I tried to just look at the last 15 and 30 minutes, but I get the same error every time, every server.