The timeout option was never configured and therefore does not try to initiate a reconnect after Azure Sentinel initiates a disconnect.
Azure Sentinel can issue a disconnect while Microsoft is moving data centers, maintenance is being done, or during an outage.
By default the timeout value is 0 which is disabled and therefore a reconnect will not be attempted.
Please set the timeout value to 30 seconds or more, depending on the needs of the environment.
One Identity support recommends a timeout value of 60 seconds to start, and if the issue reoccurs, setting the timeout value even higher until the issue no longer exists.
The timeout value can be found by logging into the SSB's WebUI, and then navigating to Log > Destinations, and then locate the destination in question and apply the change. Please see the below screenshot for where to set the value:
For more information on the timeout value please see the timeout option within the administrative guide for the SSB being run within the environment.
© ALL RIGHTS RESERVED. Feedback Terms of Use Privacy Cookie Preference Center