Proofpoint POD Function App Issue: event_type=message

[Kashishav]

Hello,
We're having issues with collecting "message" logs from the function app. "Maillog" is coming in as expected.
The error we're seeing is:
Error while receiving data: maximum recursion depth exceeded while encoding a JSON object

Please let us know if you have any suggestions on a fix.

Thank you,
Kashish

[v-sudkharat]

Hi @Kashishav, Thanks for flagging this issue, we will investigate this issue and get back to you with some updates. Thanks!

[v-sudkharat]

@Kashishav,

what is the link in WEBSITE_RUN_FROM_PACKAGE of function app:

Ex :

And could you please share full invocation logs message with us, to check on it.

[Kashishav]

Hello @v-sudkharat
It was - https://aka.ms/sentinel-ProofpointSentinelConn-functionapp
I have recently changed it to - https://github.com/Azure/Azure-Sentinel/raw/c32f4c8347e79ed128f76aa76ff099d133997114/Solutions/Proofpoint%20On%20demand(POD)%20Email%20Security/Data%20Connectors/ProofpointSentinelConn.zip and this is working

I also tried - https://aka.ms/sentinel-proofpointpod-functionapp based on https://learn.microsoft.com/en-us/azure/sentinel/data-connectors/proofpoint-on-demand-email-security which doesn't work either.

NOTE: This function app was working for over a year until a few days back when the issue started.

Thank you for looking into this.

Kashish

[v-sudkharat]

@Kashishav, I see the Function Timeout has been defined to 10 Min into the Host file in here - https://github.com/Azure/Azure-Sentinel/raw/c32f4c8347e79ed128f76aa76ff099d133997114/Solutions/Proofpoint%20On%20demand(POD)%20Email%20Security/Data%20Connectors/ProofpointSentinelConn.zip

And the master one has default timeout 5min.

so, want to know, Is above package (Shared by you) in which timeout set to 10 min resolves current existing issue? Please let us know if you have any other errors.

And can you update the existing Website run from package link with this one and check is your error mentioned in issue description has been resolves :
https://github.com/Azure/Azure-Sentinel/raw/016c8c33e47cd56acaa34bb906a09ac65a2df2e3/Solutions/Proofpoint%20On%20demand(POD)%20Email%20Security/Data%20Connectors/ProofpointSentinelConn.zip

Thanks!

[v-sudkharat]

@Kashishav, waiting for your response on above comment. Thanks!

[Kashishav]

Hi @v-sudkharat,
Yes, that resolves the issue. Are there any other differences between these two packages? Also, out of curiosity, how did the package with the 5-minute timeout manage to work seamlessly until December 30, 2024?

Thank you,
Kashish

[v-sudkharat]

@Kashishav, Great.
Actually, the deployed function you're using was referencing the RAW GitHub URL path in Website Run from Package, which pointed to the old Python function file.
But recently the code has been updated -https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Proofpoint%20On%20demand(POD)%20Email%20Security/Data%20Connectors/ProofpointSentinelConn.zip
Also, the timeout depends on the customer's requirements. In the master branch, the default timeout is set, while the package we shared with you defines a 10-minute timeout.

As this issue has been resolved, closing this issue. If you still need support for this issue, feel free to re-open it any time. Thank you for your co-operation.