question

MikkoK-8684 avatar image
0 Votes"
MikkoK-8684 asked vipulsparsh-MSFT commented

Defender for Endpoint Device Timeline for servers onboarded from Azure Defender

I have onboarded a bunch of Windows Server 2019 and Linux virtual machines to Azure Defender and then enabled the Defender for Endpoint (MDE) integration.

Every other MDE feature works just fine in the MDE portal, but for some reason Device Timeline does not work.

For every server Timeline gives the following error: "Error loading items 500 [object Object] [object Object] [object XMLHttpRequest]".

This is a MDE tenant with no other devices, it's only used for the servers and it was created when I enabled the Azure Defender integration.

azure-security-center
5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

vipulsparsh-MSFT avatar image
0 Votes"
vipulsparsh-MSFT answered

@MikkoK-8684 Thanks for reaching out.

Its probably the huge amount of data your servers are generating which is causing this exception, In my test environment, every Server loads up well and does contains lots of data even when that server is not doing anything. : For example :

134956-image.png



As a test, can you select the timelines just for 30 minutes and try to see if they load up (considering 30 mins will contain less data) :
134957-image.png




Please remember to "Accept Answer" if any answer/reply helped, so that others in the community facing similar issues can easily find the solution.



image.png (87.8 KiB)
image.png (23.6 KiB)
5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

MikkoK-8684 avatar image
0 Votes"
MikkoK-8684 answered vipulsparsh-MSFT commented

Thanks @vipulsparsh-MSFT,

Good idea to try, but unfortunately there is no change.

Also the servers are not production so there should be relatively small amount of data for now... I tried to just look at the last 15 and 30 minutes, but I get the same error every time, every server.

· 3
5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

@MikkoK-8684 Let me check internally if this has been reported already, if not, you will need to create a support case for this for further investigation. I will update on this. This might take some time.

1 Vote 1 ·
MikkoK-8684 avatar image MikkoK-8684 vipulsparsh-MSFT ·

Thanks, I'll be waiting! Heres a screenshot too, if it is of interest.

134959-screenshot-2021-09-24-at-115617.png


1 Vote 1 ·

@MikkoK-8684 I just got an update from internal team to have this investigated, this is not a known issue, If you are still facing the same issue, please open a support case with M365 team and they will guide you further.

0 Votes 0 ·