List Ingestion Delays In CommonSecurityLog

Description

This KQL query will check for ingestion delays in CommonSecurityLog by DeviceVendor and DeviceProduct.

Note: Azure Sentinel scheduled alert rules are delayed by 5 minutes. This allows data types with a smaller delay to be ingested on time for the scheduled run.

Query

Microsoft Sentinel

CommonSecurityLog
| extend IngestionTime = ingestion_time()
| extend Delay = ingestion_time() - TimeGenerated
| summarize max(Delay) by DeviceVendor, DeviceProduct

References

• Handle ingestion delay in Microsoft Sentinel | Microsoft Learn
• Handling ingestion delay in Azure Sentinel scheduled alert rules – Microsoft Community Hub