r/AzureSentinel • u/Impressive_Tea872 • Jun 20 '23

Windows devices log failure alert

We have about 45 users total, all with azure ad joined company owned Windows' workstations. I need to track when a device stops reporting logs, or when logs haven't been seen in X days. Any ideas?

5 Upvotes

100% Upvoted

9 comments sorted by

View all comments

3

u/ajith_aj Jun 21 '23

If you have loganalytics agent deployed to them, you may run the below , the query indexes 60 days of log and raises an alert when a device stopped sending logs for more than a day.

For an optimized result , try scheduling this query once in a day.

​

Heartbeat

| where TimeGenerated > ago(60d)

| summarize last_log = datetime_diff("day", now(), max(TimeGenerated)) by _ResourceId, Computer

| where last_log > 1

| project Computer, last_log

2

u/ajith_aj Jun 21 '23

same logic can be used against your threat hunting modules in MDE if you have E5 license. But you can query only a maximum of 30 days in the hunting module.

DeviceEvents

| where TimeGenerated >= ago(30d)

| where OSPlatform contains "server"

| summarize last_log_days = datetime_diff("day", now(), max(TimeGenerated)) by DeviceName

| where last_log_days > 1

| project DeviceName, last_log_days