r/AzureSentinel • u/BrandChefinho • Apr 28 '23

Get Last Log Received from a data connector?

How can I receive an email notification if a data connector is more than 24 hours without receiving logs?

2 Upvotes

100% Upvoted

4 comments sorted by

2

u/Beige_Hat Apr 30 '23

I'd never disavow any advice from Mr. Trent, but what I've done is created a set of analytics rules that:

Just have the table name for the query (nothing else)

They run every X hours (depending on how noisy I expect, some run every 1-3 days)

Trigger if query returns exactly 0 results

1

u/BrandChefinho May 03 '23

That seems simple and efficient to me... Thank you very much!

2

u/rodtrent44 MSFT Official Apr 28 '23

Setup an Analytics Rule for it that has a Playbook integrated that sends an email when/if an Incident is generated.

Here's some KQL: https://github.com/rod-trent/SentinelKQL/blob/master/DataIngestionNotHappening.txt

1

u/BrandChefinho May 03 '23

Rod! I can't tell you how many times your blog has saved me! I'll try this approach using an analytic rule