Free tools Windows power users keep installed
One-click scans. No signup required.
iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
A successful Microsoft Graph request does not prove that Entra ID sign-ins made it into the Wazuh indexer. Collection, manager-side processing, forwarding, indexing, and dashboard search are separate stages. A Wazuh QA report found event processing disabled in a tested beta indexer package, but the available evidence does not establish that changing one processor setting is a supported fix for every Wazuh version. Verify where the event disappears before changing the indexer.
First, identify which Graph integration is collecting sign-ins
Wazuh documents two distinct configuration routes that can involve Microsoft Graph. They are not interchangeable blocks, and the endpoint syntax for one should not be assumed to apply to the other.
| Route | Configuration and sign-in query | What to check |
|---|---|---|
Wazuh ms-graph module |
Uses an <ms-graph> configuration with resources and relationships. The reference describes configurable resources and relationships rather than the Azure logs Graph query syntax. |
Check that the module is enabled, authentication is valid, and the configured resource and relationship actually cover the data you need. The module reference recommends API version v1.0 for production. |
| Azure logs Graph route | Configured separately under <wodle name="azure-logs"><graph>. Wazuh’s Azure logs reference lists auditLogs/signIns as a valid query path. |
Confirm that the request includes auditLogs/signIns, credentials and tenant settings are valid, and time_offset selects a suitable recent window. |
These are documented collection approaches, not evidence that one is categorically better. Confirm which block is active on the manager before troubleshooting its output.
Check whether the configured collector should have polled yet
For the ms-graph module
Review enabled, api_auth tenant, client, and secret values, the resource and relationship, API version, interval, time_delay, and run_on_start. Wazuh documents a default interval of one day. If run_on_start is not enabled, the first poll waits for the configured interval; an empty index immediately after startup may therefore be a timing issue rather than proof of failed indexing.
#1 Best Overall
- Compact and Efficient Design: The FortiGate 40F is designed for small to mid-sized businesses and enterprise branch offices, featuring a compact, fanless desktop form factor that ensures quiet operation and minimizes space usage.
- Robust Connectivity Options: Equipped with 5 GE RJ45 ports, including 1 WAN port and 4 internal ports, this model provides essential connectivity and flexibility for various network configurations in a small-scale environment.
- High-Performance Security: Offers up to 1 Gbps IPS throughput and 600 Mbps threat protection throughput, using Fortinet’s purpose-built security processor technology to deliver industry-leading performance and protection for SSL encrypted traffic.
- Advanced Threat Protection: Integrated with Fortinet’s AI-powered FortiGuard Labs, the FortiGate 40F offers comprehensive cybersecurity, identifying and mitigating both known and unknown threats to maintain robust security across your network.
- Simplified Management and Deployment: Features a user-friendly management console that provides comprehensive network automation and visibility, coupled with Zero Touch Integration with Fortinet’s Security Fabric for easy deployment.
For Azure logs
Check the Graph request, authentication, tenant configuration, and time_offset. That offset determines which recent events the request selects, so a valid request can still return no sign-ins if its time window does not include them.
These checks establish whether collection is configured and timely; they do not establish that an event passed later Wazuh stages.
Rank #2
- HARDWARE PLUS SECURITY SERVICES: FortiGate-60F Firewall Appliance bundled with 1 year of FortiCare Premium and FortiGuard Unified Threat Protection.
- UNIFIED THREAT PROTECTION (UTP): Secures against advanced online threats with comprehensive web filtering and anti-botnet technologies.
- OPTIMIZED FOR MEDIUM-SIZED BUSINESSES: Tailored for businesses needing robust security without the infrastructure of larger enterprises.
- RELIABLE CUSTOMER SUPPORT: FortiCare Premium ensures high-quality support and service continuity.
- EFFECTIVE PROTECTION: Employs advanced filtering technologies to safeguard against sophisticated threats.
Trace the event through the stages where it can disappear
Use evidence from the manager and indexer to locate the first missing stage. Wazuh documents Filebeat as a manager-output shipper and describes the indexer connector separately, so “Graph returned data” and “the dashboard shows an indexed document” are not equivalent observations.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Fix the driver behind crashes, sound loss and screen glitches3Clear out junk files and repair common Windows errors- Graph response: Determine whether the API request returned sign-in records for the relevant time window. If it returned none, stay on the query, credentials, permissions, schedule, and time-window branch.
- Manager output: Check whether the collected records appear in the manager’s event output, such as alerts or archives where applicable. If the response exists but manager output does not, investigate the module’s processing and output path before changing indexer settings.
- Forwarding: If manager-side output exists, inspect the relevant Filebeat or indexer-connector status and logs for shipping failures or rejected requests.
- Indexer processing and indexing: Check engine startup/status logs and index rejection messages. A disabled processing path and a mapping rejection produce different evidence and need different remedies.
- Dashboard search: If the document is indexed, check the selected index or data view, time range, and query. A search-visibility issue is not a collection failure.
A Wazuh user issue titled “HTTPS request confirmed via tcpdump, but no events reach the index” describes successful requests and a non-empty response without indexed records. That report concerns security/alerts_v2 and security/incidents, not Entra ID sign-ins. The reporter also said resetting the checkpoint and changing only_future_events did not resolve that case; those changes should not be treated as a general fix for this symptom.
Rank #3
- 【Up to 1100 Mbps VPN Speed 】 Hardware-accelerated WireGuard and OpenVPN-DCO deliver up to 1100 Mbps VPN throughput, over 3× faster than Brume 2 for smooth remote access and file transfers.
- 【Three 2.5G Ports & Multi-WAN】Tri-port 2.5GbE design with flexible WAN LAN configuration supports multi-gigabit wired setups, dual-ISP Multi-WAN and failover to keep home and SOHO networks online.
- 【Stealth VPN Obfuscation】VPN obfuscation disguises VPN traffic as regular HTTPS, helping you evade blocking, bypass restrictive networks and maintain stable, private connections.
- 【DPI protection】Deep Packet Inspection with visual dashboards blocks adult/gambling/malicious sites, while SQM and QoS prioritize gaming, calls, and video when bandwidth is tight
- 【OpenWrt & USB 3.0 Expansion】OpenWrt with 1GB DDR4 and 8GB eMMC lets you install plugins and build VPN, ad-blocking or NAS, while USB 3.0 Type‑C connects high-speed storage or 4G/5G dongles
What the reported one-processor issue does—and does not—show
A separate Wazuh QA report described a tested beta installation whose /usr/share/wazuh-indexer/engine/run_engine.sh contained WAZUH_SERVER_ENABLE_EVENT_PROCESSING="false". At startup, wazuh-engine.log reported: “Indexer Connector DISABLED – events will not be indexed”. The report associated the disabled event-processing path with failed Office 365 integration test events and linked the issue to Wazuh indexer issue #1768.
This is a reason to check indexer-engine processing when collection and manager output are verified, particularly in a comparable beta environment. It is not confirmation that the same cause explains every missing ms-graph event, or that changing that variable is the supported one-processor fix. The reviewed sources do not establish the exact supported change, affected release range, or final resolution of issue #1768.
Rank #4
- Runs UniFi Network for full-stack network management
- Manages 30+ UniFi Network devices and 300+ clients
- 1 Gbps routing with IDS/IPS
- Multi-WAN load balancing
- 0.96" LCM status display
Before modifying run_engine.sh or a processor setting, compare the installed package and version with the tracked issue and the package’s release guidance. A script edit without version-specific confirmation could be unsupported or ineffective. If the log does not show this disabled-connector condition, continue tracing the actual failure rather than applying the beta report’s setting as a universal remedy.
Tell a mapping rejection apart from a silent processing failure
A separate Wazuh issue reports an index rejection involving ms-graph.status: a template defined the field as keyword, while an event could supply an array or object form. The resulting mapper parsing error is an observable rejection, not the same symptom as an engine path that silently fails to process or forward events.
If indexer logs show a mapping error, inspect the rejected event’s field shape and the template mapping for the target index. If there is no rejection but no document either, continue investigating collection, manager output, forwarding, and engine state.
Quick Recap
Use the observed symptom to choose the next check
| Observed evidence | Next place to investigate |
|---|---|
| No Graph response records | Integration choice, endpoint/resource or relationship, authentication, query window, and polling schedule. |
| Graph response exists, but no manager-side event output | Collector processing and the configured manager output path. |
| Manager output exists, but nothing is indexed | Forwarding component logs, indexer engine state, and indexing rejections. |
| Indexer reports mapper parsing or field-type errors | The event’s field shape and the target index template. |
| Document exists, but a search shows no result | Dashboard data view/index selection, time range, and query. |
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
