question

HillmanCorey-4611 avatar image
0 Votes"
HillmanCorey-4611 asked HillmanCorey-4611 commented

Is it possible to create an alert in Azure Sentinel for when a data source stops feeding logs?

I am trying to create an alert query that will let me know if a specific source has not provided logs within 7 days, but I am not sure the what syntax would allow for this. It is simple to find entries older than 7 days, but is it possible to alert if there are no entries younger than 7 days available? Thanks in advance for any assistance.

azure-monitormicrosoft-sentinel
5 |1600 characters needed characters left characters exceeded
Toggle Comment visibility. Current Visibility: Visible to all users

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

1 Answer

RoyKim-2230 avatar image
1 Vote"
RoyKim-2230 answered HillmanCorey-4611 commented

You can make a log analytics query to to count the number of logs returned for a certain period and create an alert based on that. But no direct feature for that.

· 1
5 |1600 characters needed characters left characters exceeded
Toggle Comment visibility. Current Visibility: Visible to all users

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

HillmanCorey-4611 avatar image HillmanCorey-4611 ·

Excellent, this will work for my purposes! Thanks!

0 Votes 0 ·