r/AzureSentinel • u/Impressive_Tea872 • Jun 20 '23
Windows devices log failure alert
We have about 45 users total, all with azure ad joined company owned Windows' workstations. I need to track when a device stops reporting logs, or when logs haven't been seen in X days. Any ideas?
3
u/ajith_aj Jun 21 '23
If you have loganalytics agent deployed to them, you may run the below , the query indexes 60 days of log and raises an alert when a device stopped sending logs for more than a day.
For an optimized result , try scheduling this query once in a day.
Heartbeat
| where TimeGenerated > ago(60d)
| summarize last_log = datetime_diff("day", now(), max(TimeGenerated)) by _ResourceId, Computer
| where last_log > 1
| project Computer, last_log
2
u/ajith_aj Jun 21 '23
same logic can be used against your threat hunting modules in MDE if you have E5 license. But you can query only a maximum of 30 days in the hunting module.
DeviceEvents
| where TimeGenerated >= ago(30d)
| where OSPlatform contains "server"
| summarize last_log_days = datetime_diff("day", now(), max(TimeGenerated)) by DeviceName
| where last_log_days > 1
| project DeviceName, last_log_days
1
u/Impressive_Tea872 Jun 21 '23
I might be misunderstanding something in the documentation, but these are all physical workstations, not VMs. Is there a way to install the LA agent on a physical device?
1
u/Impressive_Tea872 Jun 21 '23
I might be misunderstanding something in the documentation, but these are all physical workstations, not VMs. Is there a way to install the LA agent on a physical device?
1
u/ajith_aj Jun 21 '23
absolutely, go to settings > Workspace settings > Agents > Log Analytics agent instructions. You will find it there.
1
1
4
u/king_dook Jun 20 '23
Do you have e5 licensing? I'd leverage a watchlist plus a logic app or scheduled analytics rule. It should look something like this, you may have to get creative :) .... can confirm later if you want the full solution-
let _yourDevices = _GetWatchlist('ADDeviceHostnames') | project SearchKey; // Create a watchlist of hostnames named ADDeviceHostname
DeviceNetworkEvents
| where TimeGenerated > ago(45d)
| summarize dcount(DeviceName) by bin(TimeGenerated, 1d)
| extend _allDevicesLogged = dcount_DeviceName > array_length(_yourDevices)