Forum Discussion
Sentinel connector notification
Hello, Is there a way to create a query alert whenever a data connector is disconnected then an alert is created? I've noticed some connectors are disconnected and we didn't know about it. Th...
For some connectors you can use Sentinel Health. https://docs.microsoft.com/en-us/azure/sentinel/monitor-data-connector-health
However as the above is not (yet) a complete solution many people look at time based checks, similar to this one today: https://techcommunity.microsoft.com/t5/microsoft-sentinel/alerting-when-data-are-missing/m-p/3595737
e.g. Alert if no data is received in the past 5mins (this can be prone to false positives, due to latency, or unexpected slow downs, day of week, day of year delays). You may need a threshold per table in some cases.
The other option is anomaly detection (which is limited by the 14day Alert lookback limit, so is prone to false positives as well, 14days isn't enough to check if the pattern today was the same as this time last month for example, if a source maybe always sends nothing on the 3rd of each month)
However as the above is not (yet) a complete solution many people look at time based checks, similar to this one today: https://techcommunity.microsoft.com/t5/microsoft-sentinel/alerting-when-data-are-missing/m-p/3595737
e.g. Alert if no data is received in the past 5mins (this can be prone to false positives, due to latency, or unexpected slow downs, day of week, day of year delays). You may need a threshold per table in some cases.
The other option is anomaly detection (which is limited by the 14day Alert lookback limit, so is prone to false positives as well, 14days isn't enough to check if the pattern today was the same as this time last month for example, if a source maybe always sends nothing on the 3rd of each month)