Sentinel Data Connector Health

Query

SentinelHealth
| where TimeGenerated > ago(3d)
| where OperationName == 'Data fetch status change'
| where Status in ('Success', 'Failure')
| summarize TimeGenerated = arg_max(TimeGenerated,*) by SentinelResourceName, SentinelResourceId
| where Status == 'Failure'

About this query

Explanation

The query is used to monitor the health of data connectors in Microsoft Sentinel.

The first query detects the latest failure events per connector by filtering for events where the operation name is "Data fetch status change" and the status is either "Success" or "Failure". It then summarizes the results by the latest time generated for each connector and filters for events where the status is "Failure".

The second query detects connectors that have changed from a failed state to a successful state. It first retrieves the latest status for each connector within the last 12 hours and stores it in the "lastestStatus" variable. It then retrieves the next-to-latest status for each connector within the last 12 hours and stores it in the "nextToLastestStatus" variable. The two variables are then joined based on the connector name and ID, and filtered for events where the next-to-latest status is "Failure" and the latest status is "Success".

The third query is similar to the second query, but it detects connectors that have changed from a successful state to a failed state. It follows the same steps as the second query, but filters for events where the next-to-latest status is "Success" and the latest status is "Failure".

KQL Search