Is it possible to create an alert in Azure Sentinel for when a data source stops feeding logs?

Corey 21 Reputation points
2020-06-18T16:10:30.507+00:00

I am trying to create an alert query that will let me know if a specific source has not provided logs within 7 days, but I am not sure the what syntax would allow for this. It is simple to find entries older than 7 days, but is it possible to alert if there are no entries younger than 7 days available? Thanks in advance for any assistance.

Azure Monitor
Azure Monitor
An Azure service that is used to collect, analyze, and act on telemetry data from Azure and on-premises environments.
2,797 questions
Microsoft Sentinel
Microsoft Sentinel
A scalable, cloud-native solution for security information event management and security orchestration automated response. Previously known as Azure Sentinel.
974 questions
0 comments
Accepted answer
  1. Roy Kim (Azure MVP) 181 Reputation points MVP
    2020-06-18T16:34:20.06+00:00

    You can make a log analytics query to to count the number of logs returned for a certain period and create an alert based on that. But no direct feature for that.

    1 person found this answer helpful.

0 additional answers

Sort by: Most helpful
Most helpful Newest Oldest