search cancel

Reporter filtering failing with ORed queries

book

Article ID: 227402

calendar_today

Updated On:

Products

Web Security Service - WSS

Issue/Introduction

WSS admin wants to get a oveview of Sharepoint app usage that excludes corporate domain and svc.ms to get better understand what employees are doing with non-corporate Sharepoint sites

Example filter shown below showing requested parameters

After executing the filter, there are still reports of svc.ms and corporate domains (cashell.com here) despite the request not to include - filter does not appear to be working properly

 

Cause

There's a bug in the reporting logic triggered by the ORing of two entries under site

Resolution

A fix will be available in Dec '21.

Workaround until then this to run two separate reports for the domains we want to avoid and merge together to filter out what is needed.

Attachments