Sentinel integration Incidents are not getting processed from sn_sec_sentinel_incident_raw table into Security Incident Table. - Known Error

Sentinel integration Incidents are not getting processed from sn_sec_sentinel_incident_raw table into Security Incident Table. Description Azure Sentinel Integration Security Incidents are not getting Created, Records are not getting processed from sn_sec_sentinel_incident_raw table into Security Incident Table.

In the version 11.0.24 and above, you see the records are not getting processed from sn_sec_sentinel_incident_raw table, stopping the SIR incident creation.

The issue can verified if it is due to this by checking the log messages in the instance, you would see multiple log info message records with this ' Skipping update as the Security Incident is closed :'.

Steps to Reproduce

1. Records are not getting processed from sn_sec_sentinel_incident_raw table, more than 100 records are stuck in 'Ready to process' state.

2. Security Incidents are not getting generated

Workaround This is a known defect from 11.0.24, we are attaching the update set here in the link UpdateSet . We are providing fix in the July Store Patch Release.