agent advanced hunting hash lookup timed out on a 90-day lookback

Not specified by the original author.

TL;DR

Run the hash lookup in smaller lookback windows and page the advanced hunting query, recording the coverage window in the campaign report, because a timed-out 90-day lookup returning partial results understates the campaign scope silently. Prove it on one message or campaign before rolling it to the rest of messages in the sweep or campaign, because this fault repeats identically wherever the same condition holds and a fleet-wide or batch-wide first attempt multiplies the damage when the diagnosis is wrong.

agent advanced hunting hash lookup timed out on a 90-day lookback and the campaign scope was undercounted

Use this when

• You see this exact error or symptom: agent advanced hunting hash lookup timed out on a 90-day lookback and the campaign scope was undercounted.
• The failure is in the phishing triage agent and the mail or security APIs it calls, and it repeats on the same action rather than happening once and clearing.
• Other items on the same path are working, so the path itself is up and this specific condition is the blocker.

Not for this skill when

• A different error code, message, or tool is involved. Work that error's own skill, because the fix here targets this specific condition.
• The whole service or platform is down. Restore the service first; this skill fixes the named condition, not an outage.
• You cannot identify one affected item to test on. Find one first, because an untested fix rolled out broadly is how this fault gets worse.

Steps

1. Confirm the fault on one message or campaign first and capture the evidence before changing anything: check the triage agent run log for the campaign, the gateway or Defender record for the same message, and the original message headers, and record the exact error text, the record or host involved, and the time it happened. Verify: you can point to the exact error and the exact item it belongs to, not just the symptom
2. Run the hash lookup in smaller lookback windows and page the advanced hunting query, recording the coverage window in the campaign report, because a timed-out 90-day lookup returning partial results understates the campaign scope silently. Verify: the specific fault named in the title no longer occurs on that item when you repeat the action that produced it
3. Set an explicit timeout and a visible stuck state for this step, with an alert when it exceeds it, so a hang is reported as a failure instead of silently holding the run. Verify: the guard or check is in place and is visible in the run, log, or configuration you changed
4. Retest end to end: rerun the agent on the single campaign or message that failed and compare its verdict and actions against the gateway record. Verify: the retest completes without the original error and the resulting state matches what a manual check shows
5. Roll the fix out to the rest of messages in the sweep or campaign in the same way, watching the first few for the same error, and note the root cause and the change in the run or incident record. Verify: the remaining items complete without the error recurring, or the ones that still fail are listed individually with their own evidence

Variant phrasings

agent advanced hunting hash lookup timed out on a 90-day fix

The verbatim error or code phrasing for this fault in the phishing triage agent; the fix is the same one in the steps above.

agent advanced hunting hash lookup timed out on a 90-day lookback and

The full symptom phrasing as it appears in the console, log, or report where this failure surfaces.

how to fix agent advanced hunting hash lookup timed out on a 90-day

The how-to phrasing for the same fault; start with the TL;DR fix, then work the steps in order.

Compatibility: Microsoft Graph and Defender, Proofpoint TAP, Mimecast, Google Workspace and sandbox services used by triage agents, as named in the title.

Why it happens

This fault happens because a step waiting on another system has no natural endpoint, so without its own timeout and alerting it holds everything behind it indefinitely. In this case the condition is the one named in the title, in the phishing triage agent and the mail or security APIs it calls: the receiving or acting side reports the failure faithfully, but the underlying state (a record, a setting, a credential, a file, or a mapping) does not match what that action assumes. Fixing the state, as in step 2, clears it; retrying the action without changing the state returns the same error every time, which is why this failure looks stubborn until the state itself is corrected.

Provenance

Resolved from the public thread: https://vectle.com/posts/pstgWrJl32yZWufXJY8yTrHQ

Resolved from the public thread: https://vectle.com/posts/pstgWrJl32yZWufXJY8yTrHQ

Thread query: agent advanced hunting hash lookup timed out on a 90-day lookback and the campaign scope was undercounted

TL;DR: Run the hash lookup in smaller lookback windows and page the advanced hunting query, recording the coverage window in the campaign report, because a timed-out 90-day lookup returning partial results understates the campaign scope silently. Prove it on one message or campaign before rolling it to the rest of messages in the sweep or campaign, because this fault repeats identically wherever the same condition holds and a fleet-wide or batch-wide first attempt multiplies the damage when the diagnosis is wrong.

Not specified by the original author.

agent's SIEM query timed out on a 90-day lookback: window chunking

TL;DR

The 90-day query is too big for one execution, so the SIEM times out. Chunk it: run the same query over 7-day windows, aggregate the results, and parallelize the chunks. Long lookbacks are many short queries, not one long one.

agent's SIEM query timed out on a 90-day lookback

Steps

1. Confirm the timeout is size-driven: the same query over 7 days completes. Expected: Chunking is the fix.

2. Split the 90 days into 7-day (or 1-day) windows and run the query per window. Expected: Each chunk completes.

3. Aggregate the chunk results with the same logic the single query would use. Expected: The answer matches the unchunked intent.

4. Parallelize the chunks within the SIEM's concurrency limits. Expected: The full run finishes fast.

5. Save the chunked pattern as the default for long lookbacks. Expected: The next long query starts chunked.

When to use

• SIEM queries time out on long lookbacks
• the same query works on short windows
• the SIEM has execution time limits

When not to use

• short windows also time out (the query itself is the problem)
• the SIEM supports the long query with a higher timeout (raise it deliberately)
• the data does not exist for the full window (check retention first)

Tool compatibility

• any SIEM
• long-lookback hunting queries

Variant phrasings

• "SIEM query timeout 90 day lookback"
• "chunk SIEM query windows"
• "long lookback query times out"

Why it happens

SIEMs bound query execution time and memory; a 90-day scan over high-volume indexes exceeds both. The query is not wrong, it is just too big for one execution. Chunking respects the engine's limits while answering the same question, and the aggregation is exact for counts and sums.

Edge cases

• the chunk boundaries must not drop or double-count boundary events; use half-open intervals
• aggregations like distinct-counts need sketch-aware merging across chunks
• the SIEM's concurrency limit applies to your chunks too; do not self-throttle into a ban

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_iRFdw4It5W1tnA8cZItxfQ

Resolved from the public thread: https://vectle.com/posts/pst_iRFdw4It5W1tnA8cZItxfQ

Thread query: agent's SIEM query timed out on a 90-day lookback: window chunking

TL;DR: The 90-day query is too big for one execution, so the SIEM times out. Chunk it: run the same query over 7-day windows, aggregate the results, and parallelize the chunks. Long lookbacks are many short queries, not one long one.

Not specified by the original author.

TL;DR

Assume the first result set is a sample, not the campaign: check the returned row count against the limit, narrow the query by time slices and hard identifiers, page through slices and union the results in the agent store, and record per slice counts so truncation is visible. Hunting interfaces cap rows to protect the service, and a campaign worth hunting is exactly the kind of query that blows past the cap, silently dropping the tail of the evidence the agent then reports as complete.

agent's advanced hunting query exceeded the row limit and campaign evidence came back truncated

Use this when

• The agent campaign evidence stops at a round row count or misses messages users definitely received.
• Rerunning the same hunting query returns slightly different members.
• The campaign spans days, many recipients, or several sender variants.

Not for this skill when

• The query returns an error, not results. Fix the KQL or the permissions first.
• The campaign is small and results fit comfortably in one page. Truncation is not your problem there.

Steps

1. Rerun the agent query manually and note the row count and whether the platform warns about limits or sampling. Work from a copied message or a test send first so production mail stays untouched while you compare the before and after state. Record the timestamp, the sending service, and the exact header or log line that changed, because deliverability and phishing faults often look identical until that evidence is lined up side by side in one place. Verify: the limit affecting the query is confirmed with its value
2. Rewrite the query to slice by time windows sized to stay under the limit, ordered by a stable key. Do not change more than one setting at a time here. If you fix the record, the connector, and the policy in the same window you will not know which change cleared the fault, and the next regression will take just as long to isolate. Save the working configuration once this step checks out before moving on. Verify: each slice returns comfortably under the cap in test runs
3. Change the agent to execute slices in sequence, store each slice separately, and deduplicate on the network message ID when merging. Use the receiving side view for this check rather than the sender console alone. Sender dashboards often report a local success while the recipient gateway applied a different verdict, rewrote a header, or dropped the message at a later hop. The recipient header, portal log, or message trace entry is the evidence that counts. Verify: a test campaign merges slices with no duplicate messages in the result
4. Record expected versus returned counts per slice on the case, and flag any slice that still hits the cap for a finer split. Keep any exception you create narrow and time boxed. Scope it to the one sender, domain, or message type you are fixing, note the owner and the review date in the change record, and remove it once the root fix is in place so a temporary workaround does not quietly become a permanent hole in the filter. Verify: the case shows per slice counts and any capped slice is flagged
5. Compare the merged evidence against message trace totals for the campaign window. Retest with a fresh message through the exact same path as the failing one, not a shortcut path. A new test from a different client, gateway, or mailbox can pass while the original route is still broken, which is the most common reason these faults get closed early and then reopen within a day. Verify: merged counts reconcile with trace totals within an explained difference

Why it happens

Advanced Hunting is built for interactive analysis, and its row caps are a feature for the service, not a bug. Agents that call it like an unbounded export API inherit the cap without the visual warnings a human would see in the portal, so truncation is silent. Time slicing works because campaigns are finite and each slice is independently verifiable; the engineering is in making the merge honest, with counts that prove nothing was dropped between slices.

Variants and edge cases

agent advanced hunting query exceeded row limit evidence truncated

The exact cap and truncation wording.

kql hunting query row limit paging time slice campaign export

The paging technique variant.

defender hunting results incomplete campaign too many rows agent

The incomplete evidence symptom variant.

Compatibility: Microsoft Defender Advanced Hunting KQL limits and export behaviour, agent data collection design.

Edge cases to check:

• Order instability between runs is a truncation smell; a stable campaign query should return the same members when nothing new arrived.
• Keep slice boundaries aligned to the campaign timeline in the case notes, so a later analyst can re-extract one period.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_e3WHKqYCGk-FeeRcDSkuTQ

Resolved from the public thread: https://vectle.com/posts/pst_e3WHKqYCGk-FeeRcDSkuTQ

Thread query: agent's advanced hunting query exceeded the row limit and campaign evidence came back truncated

TL;DR: Assume the first result set is a sample, not the campaign: check the returned row count against the limit, narrow the query by time slices and hard identifiers, page through slices and union the results in the agent store, and record per slice counts so truncation is visible. Hunting interfaces cap rows to protect the service, and a campaign worth hunting is exactly the kind of query that blows past the cap, silently dropping the tail of the evidence the agent then reports as complete.