Monitoring Microsoft Sentinel Analytical Rules – Push Health Notifications

Sreedhar_Ande Thank you for the post as we had run into this issue and spent a long time trying to find any supporting log data in Azure Sentinel as to why this happen and how we can monitor this.

I have setup a test environment to try this playbook in which I have removed access to the Azure Sentinel Workspace used in my Analytical queries but 15 hours later and there is still no sign of any "Auto Disabled" rules.

I am seeing permission errors when trying to validate the query which matches what is listed under permanent failure conditions.

Could you let me know what the timeframe or threshold is for it to trigger?

Is there no other way to see these query failures and changes in any audit log?

Monitoring Analytical Rule queries for failure is a critical part of anyone especially service providers.

Thanks

Gernot