Error 400 with MDE collector

[marckto-filigran]

Hello,

we have a http 400 error with the MDE collector:

Error collecting: APIError Code: 400 message: None error: MainError(additional_data={}, code='BadRequest', details=None, inner_error=InnerError(additional_data={}, client_request_id='96fa4e97-575d-4732-acdc-b3a63aec0ca3', date=DateTime(2024, 12, 11, 14, 33, 31, tzinfo=Timezone('UTC')), odata_type=None, request_id='cad88e59-9919-4a44-900e-3391c3483acb'), message="'summarize' operator: Failed to resolve scalar expression named 'TimeGenerated'. Fix semantic errors in your query.", target=None)

[antoinemzs]

Hi @marckto-filigran, thanks for this. All testing had went ok here on various openbas instances, however we only use a single tenant configuration for MS Defender.

I believe @Dimfacion is in touch with you currently but I have provisioned a tentative fix that circumvents the alleged error in your original post.