Sentinel Analytic rules still show up in SentinelHealth despite being deleted

Question

Hi,

I am currently trying to learn Sentinel through my lab tenant. I've managed to connect some data connectors and data is coming in to my Sentinel environment.

Now, I've started to mess around with the analytic rules. I've created a few and enabled them. Some of them triggered alerts and generated incidents and others did not (I have to look at the KQL). My question is, I deleted some rules and they've disappeared from my analytic rule page.

However, when I go to the dashboard of my Sentinel, I can see that there is "a lot" of data that comes in from SentinelHealth:

When I check the SentinelHealth logs, I can see that the analytic rules that I have deleted are still running...

Is there something else I need to do? I Maybe wait for a "sync" or something?

//Andreas Bjelvén

Answer 1

@Andreas Bjelven

Thank you for posting your query on Microsoft Q&A, from above description I could understand that you have created sentinel analytics rules, got events triggered and later deleted the rule however the events are showing up in dashboard and audit details of the sentinel health.

Please do correct me by responding in the comments for any discrepancies.

Sentinel dashboard does hold the data for past 24 hours to 30 days. Any events generated by the rules before deletion may show up within the dashboard as the events have been saved in the workspace.

• Same goes with SentinelHealth and SentinelAudit data tables:

The following types of analytics rule health events are logged in the SentinelHealth table:

• Scheduled analytics rule run.
• NRT analytics rule run.
• For more information, see SentinelHealth table columns schema.

The following types of analytics rule audit events are logged in the SentinelAudit table:

• Create or update analytics rule.
• Analytics rule deleted.
• For more information, see SentinelAudit table columns schema.

The screenshot you have shared have the deleted log of the rule, so it would show up but there won't be any new events generated:

---Please "Accept the answer (Yes)" and "share your feedback ". This will help us and others in the community as well.

Thanks, Akshay Kaushik