Forum Discussion

TheHoff70's avatar
TheHoff70
Brass Contributor
Nov 08, 2022

Sentinel went missing yesterday

Greetings I few weeks ago a set up a fresh Log Analytics workspace and purchased Sentinel for it. Both are set up as PayGo for now. Yesterday when I came to work I was greeted by the error message "...
siem
soar
Rod_Trent's avatar
Rod_Trent
Icon for Microsoft rankMicrosoft
Nov 08, 2022
Still like that today? Does anyone else have delete access to that resource group?

I assume by OMS, you mean a Log Analytics workspace.
TheHoff70's avatar
TheHoff70
Brass Contributor
Nov 08, 2022

Correct, that should all be Log Analytics workspace. I'm looking for the Azure Activity logs as we speak but I doubt someone could have deletede the Sentinel Instance by mistake. Also Sentinel is still visible for the workspace if I go to Azure-Resources-Sentinel.

Update: There is no delete event in the Azure monitor logs for the Sentinel instance but a health event for this Saturday with the title "More than 1 hour latency" but it's shown as resolved



/Fredrik

  • Rod_Trent's avatar
    Rod_Trent
    Icon for Microsoft rankMicrosoft
    Nov 08, 2022
    If you haven't already, you will need to open a ticket for this one.

    Happy to track it in the system if you need that. You can send me a private message here on Techcommunity.
    • TheHoff70's avatar
      TheHoff70
      Brass Contributor
      Nov 08, 2022

      Hi
      The partner just came back with the Microsoft ticket 2211100050001204 I don't know if that means anything to you.

    • TheHoff70's avatar
      TheHoff70
      Brass Contributor
      Nov 08, 2022
      I appreciate that. Thing is our Azure subscription is handled through a partner and they are sometimes slow to respond, but a case hase been registered with them.

Resources