Turn on health monitoring for Microsoft Sentinel (preview)
Monitor the health of supported Microsoft Sentinel resources by turning on the health monitoring feature in Microsoft Sentinel's Settings page. Get insights on health drifts, such as the latest failure events or changes from success to failure states, and use this information to create notifications and other automated actions.
To get health data from the SentinelHealth data table, you must first turn on the Microsoft Sentinel health feature for your workspace.
When the health feature is turned on, the SentinelHealth data table is created at the first success or failure event generated for supported resource types.
The following resource types are currently supported:
- Data connectors
- Automation rules
- Playbooks (Azure Logic Apps workflows)
When monitoring playbook health, you'll also need to collect Azure Logic Apps diagnostic events from your playbooks in order to get the full picture of your playbook activity. See Monitor the health of your automation rules and playbooks for more information.
To configure the retention time for your health events, see Configure data retention and archive policies in Azure Monitor Logs.
Turn on health monitoring for your workspace
In Microsoft Sentinel, under the Configuration menu on the left, select Settings.
Select Settings from the banner.
Scroll down to the Health monitoring section that appears below, and select it to expand.
Select Configure Diagnostic Settings.
In the Diagnostic settings screen, select + Add diagnostic setting.
In the Diagnostic setting name field, enter a meaningful name for your setting.
In the Logs column, select the appropriate Categories for the resource types you want to monitor, for example Data Collection - Connectors.
Under Destination details, select Send to Log Analytics workspace, and select your Subscription and Log Analytics workspace from the dropdown menus.
Select Save on the top banner to save your new setting.
The SentinelHealth data table is created at the first success or failure event generated for the selected resources.
Access the SentinelHealth table
In the Microsoft Sentinel Logs page, run a query on the SentinelHealth table. For example:
SentinelHealth | take 20
- Learn what health monitoring in Microsoft Sentinel can do for you.
- Monitor the health of your Microsoft Sentinel data connectors.
- Monitor the health of your Microsoft Sentinel automation rules.
- See more information about the SentinelHealth table schema.