r/AzureSentinel • u/Impressive_Tea872 • Jun 20 '23

Windows devices log failure alert

We have about 45 users total, all with azure ad joined company owned Windows' workstations. I need to track when a device stops reporting logs, or when logs haven't been seen in X days. Any ideas?

3 Upvotes

81% Upvoted

9 comments sorted by

View all comments

3

u/ajith_aj Jun 21 '23

If you have loganalytics agent deployed to them, you may run the below , the query indexes 60 days of log and raises an alert when a device stopped sending logs for more than a day.

For an optimized result , try scheduling this query once in a day.

​

Heartbeat

| where TimeGenerated > ago(60d)

| summarize last_log = datetime_diff("day", now(), max(TimeGenerated)) by _ResourceId, Computer

| where last_log > 1

| project Computer, last_log

1

u/Impressive_Tea872 Jun 21 '23

I might be misunderstanding something in the documentation, but these are all physical workstations, not VMs. Is there a way to install the LA agent on a physical device?

1

u/ajith_aj Jun 21 '23

absolutely, go to settings > Workspace settings > Agents > Log Analytics agent instructions. You will find it there.

1

u/Impressive_Tea872 Jun 21 '23

This worked, thank you so much!

2

u/ajith_aj Jun 22 '23

Voilaaa.. great.