5.9 Workspace Health and Monitoring

1
2
3
4
5
6
7

// Check the last event time per data type
union withsource=TableName *
| where TimeGenerated > ago(24h)
| summarize LastEvent = max(TimeGenerated), EventCount = count() by TableName
| extend HoursSinceLastEvent = round(datetime_diff('minute', now(), LastEvent) / 60.0, 1)
| where HoursSinceLastEvent > 1
| sort by HoursSinceLastEvent desc

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15

// Compare today's ingestion to the 7-day average per table
let baseline =
    Usage
    | where TimeGenerated between (ago(8d) .. ago(1d))
    | where IsBillable == true
    | summarize AvgDailyMB = round(avg(Quantity), 0) by DataType;
Usage
| where TimeGenerated > ago(1d)
| where IsBillable == true
| summarize TodayMB = round(sum(Quantity), 0) by DataType
| join kind=inner baseline on DataType
| extend PercentChange = round((TodayMB - AvgDailyMB) * 100.0 / AvgDailyMB, 0)
| where abs(PercentChange) > 50
| project DataType, TodayMB, AvgDailyMB, PercentChange
| sort by abs(PercentChange) desc

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11

// Check which analytics rules fired (or failed) in the last 24 hours
SentinelHealth
| where TimeGenerated > ago(24h)
| where SentinelResourceType == "Analytic rule"
| summarize
    Succeeded = countif(Status == "Success"),
    Failed = countif(Status == "Failure"),
    LastRun = max(TimeGenerated)
    by SentinelResourceName
| where Failed > 0
| sort by Failed desc