Hello,
We are experiencing an issue with the Cisco Firepower eStreamer integration to Microsoft Sentinel. We successfully integrated the eStreamer and started receiving logs from Cisco Firepower to Microsoft Sentinel. However, after 2 or 3 days, the logs stopped being ingested into Microsoft Sentinel.
When we restarted the eStreamer, the logs resumed flowing into Microsoft Sentinel, but the issue repeats after a few days.
We have been using the Cisco Firepower eStreamer enCore Sentinel Operations Guide and the CiscoSecurity fp-05-microsoft-sentinel-connector GitHub repository for the integration.
However, we are encountering the following error in the logs, which seems to be causing a failure in the log ingestion process:
2024-12-12 09:49:37,014 Subscriber INFO Stop message received
2024-12-12 09:49:37,015 Monitor ERROR Monitor __start: 'TypeError' object has no attribute 'message'
2024-12-12 09:51:37,617 Subscriber INFO Exiting
2024-12-12 09:51:37,617 Controller INFO Process 2000662 (Process-1) exit code: 0
2024-12-12 09:51:37,617 Parser INFO Stop message received
How can we resolve the TypeError: 'TypeError' object has no attribute 'message' error and prevent the logs from stopping after a few days in the eStreamer integration with Microsoft Sentinel?
