List Data Connector Failures In The Last Three Days
Description
This KQL query detects latest failure events per Data Connector in the last three days.
Risk
Failures in Data connectors mean that no data is being ingested thus no potential alerts will be triggered.
Query
Microsoft Sentinel
Kusto
SentinelHealth
| where TimeGenerated > ago(3d)
| where OperationName == 'Data fetch status change'
| where Status in ('Success', 'Failure')
| summarize TimeGenerated = arg_max(TimeGenerated,*) by SentinelResourceName, SentinelResourceId
| where Status == 'Failure'