Microsoft Exchange Logs and Events errors when deploying MessageTrackingLog and ExchangeHttpProxy collectors

[micholczyk]

Describe the bug
When configuring Microsoft Exchange Logs and Events connector steps regarding [Option 6] Message Tracking of Exchange Servers and [Option 7] HTTP Proxy of Exchange Servers manual deployment fail with errors:
Update Error - Error occurred while compiling query in query: SemanticError:0x00000006 at 1:43 : Undefined symbol: date-time
Update Error - Error occurred while compiling query in query: SemanticError:0x00000006 at 1:43 : Undefined symbol: DateTime

To Reproduce
Steps to reproduce the behavior:

1. Go to Microsoft Sentinel -> Data connectors -> Microsoft Exchange Logs and Events.
2. Scroll down to Configuration -> 2. Deploy log injestion following choosed options -> [Option 6] Message Tracking of Exchange Servers -> Option 2 - Manual Deployment of Azure Automation and follow the instructions there.
3. The error happens in step 4. of C. Modify the created DCR, Type Custom log when configuring a Data Source of Custom Text logs type with the provided KQL.
4. The same applies to [Option 7] HTTP Proxy of Exchange Servers.

Expected behavior
The connector should start collecting logs.

Screenshots
[Option 6] Message Tracking of Exchange Servers
First error shows up after uploading the example file (expected?).

After transformation there is no error.

After performing the steps in C. Modify the created DCR, Type Custom log there is the following error.

After page refresh the Data sources are gone.

[Option 7] HTTP Proxy of Exchange Servers
Again - first error shows up after uploading the example file. Probably expected.

Transformation seems ok.

In step C. Modify the created DCR, Type Custom log same exact error appears.

Desktop (please complete the following information):

• OS: Windows 11
• Browser: Edge
• Version: 126.0.2592.87

If I'm doing something wrong, or not understanding something correctly, I'd be glad for your advice. :) Thanks!

[v-sudkharat]

Hi @micholczyk, Thanks for flagging this issue, we will investigate this issue and get back to you with some updates by 25-07-2024. Thanks!

[micholczyk]

Hello, any news on this issue?

[v-sudkharat]

Hi @micholczyk, Sorry for delay in response, we need some more time to investigate this issue from our end. Thanks!

[v-sudkharat]

Adding, @v-prasadboke

[mt-tw]

@v-prasadboke @v-sudkharat are there any updates on this issue please?

[saahilverma]

@v-prasadboke @v-rusraut @v-sudkharat Can we get update on this... Seems like lot of people stuck at transform.

[nlepagnez]

Hi,
There was a bug in the way we proposed to implement the DCR manually when the ‘Custom Logs’ DCR was in preview.
A Pull Request is in progress #11049

[saahilverma]

Hello @v-prasadboke @v-sudkharat do we have fix now on the data connecter here ?

[v-sudkharat]

@saahilverma, The PR still is in review state, once it gets merge, the changes will get updated into upcoming solution version. Thanks!

[thom2804]

I see that #11049 is still stuck on merging, is there any forecast on when to expect these changes to be completed?
Steps 6 and 7 have been broken since January now.... :/ (check #9862)