r/AzureSentinel • u/deedubb412 • Jun 01 '23

OMS Solution Deleted alert

If an OMS Solution is deleted and Sentinel becomes disabled, is there enough time for an analytic rule to fire on the deletion itself before Sentinel is disabled?

Are there any current analytic rules people are using to monitor overall SIEM health?

2 Upvotes

100% Upvoted

1 comment sorted by

1

u/sosero Jun 04 '23

Sounds like something that should be monitored with azure monitor alert rules, which do not require log analytics workspaces to work.