Sentinelhealth Sentinel Failure

KQL detection rule by ep3p · MIT

No description provided

let alert_name = "Sentinel health";
let _ExpectedAlertNames = toscalar(
    _GetWatchlist("Activity-ExpectedSignificantActivity")
    | where Activity == "SentinelHealthAlert"
    | summarize make_list(Auxiliar)
);
SentinelHealth
| extend
    Issues = ExtendedProperties["Issues"],
    FailureSummary = ExtendedProperties["FailureSummary"],
    IncidentNumber = ExtendedProperties["IncidentNumber"]
| mv-expand Issue = iff(array_length(Issues) > 0, Issues, dynamic([""])), Failure = iff(array_length(FailureSummary) > 0, FailureSummary, dynamic([""]))
| where not(Status == "Success" and isempty(Issue) and isempty(FailureSummary))
| extend
    IssueCode = tostring(Issue["Code"]),
    StatusCode = tostring(Failure["StatusCode"]),
    Auxiliar = iff(SentinelResourceType == "Analytics Rule", SentinelResourceName, tostring(bin(TimeGenerated, 1h)))
| extend AlertName = case(
    SentinelResourceType == "Analytics Rule" and Status == "Warning" and Reason == "The analytics rule is disabled and was not executed.", "Analytics rule was auto disabled",
    SentinelResourceType == "Analytics Rule" and isnotempty(IssueCode), strcat(alert_name, " - ", SentinelResourceType, " - ", Status, " - ", IssueCode),
    SentinelResourceType == "Data connector", strcat(alert_name, " - ", SentinelResourceType, " - ", Status, " - ", SentinelResourceName),
    SentinelResourceType == "Automation rule", strcat(alert_name, " - ", SentinelResourceType, " - ", Status, " - Incident Number ", IncidentNumber),
    strcat(alert_name, " - ", SentinelResourceType, " - ", Status)
    )
| where not(AlertName in (_ExpectedAlertNames))
| project
    TimeGenerated,
    AlertName,
    SentinelResourceType,
    SentinelResourceKind,
    SentinelResourceName,
    OperationName,
    Status,
    Reason,
    Description,
    Issues,
    FailureSummary,
    ExtendedProperties,
    SentinelResourceId,
    Auxiliar

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

341abe2f-a53d-4131-bdde-dd65708c73d4

Propose edits, view related rules, and engage with the community through comments.

Executable code, not a declarative rule

This submission is arbitrary [[ currentRule.format ? currentRule.format.toUpperCase() : '' ]] code, not a declarative detection rule — review it as you would any script before running it, and note that it cannot be safely aggregated or auto-executed alongside YARA/Sigma/Suricata/CRS rules.

Rejected pattern present

[[ reason ]]

What does this mean?

Format & documentation suggestions

Not a security issue — this rule is valid and was accepted as-is. These are optional fields/conventions its own format recommends, mainly affecting its quality score and how well it documents itself for other reviewers.

[[ reason ]]

What do these messages mean?

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

[[ currentRule.title ]]

Community Discussion