Issues with feed source total indicator number mismatch and timestamp issue

[Gladsy7]

1. Seeing Issues with the total indicator number mismatch after the integration with elastic, compared to the actual number listed in TC. There was a total of 10 indicators missing from the actual number shown in TC.

2. Timestamp Issues are seen after integration, seeing errors on Unable to display indicator information
   
   with Elastic

[jvalente-salemstate]

Is TC ThreatConnect? Or is this from a different integration?

The tables and JSON tables should still show your original document. I am seeing this from the M365 Defender integration (event data stream, for AlertInfo) and that is happening when the event.type is indicator without any indicator details.

[Gladsy7]

@jvalente-salemstate Yes TC is Threat Connect. Yea, no all the indicators.