Forum Discussion
SentinelHealth: Scheduled Rule Retry Logging Does Not Match Docs
## Objective I am working on a health checks architecture for Microsoft Sentinel analytic rules. The goal is to build a set of monitoring queries/approaches that cover rule execution failures, confi...
Hi, this is the sort of Sentinel issue where I would compare docs against real telemetry very carefully before building monitoring around it.
I would validate:
1. Rule type and schedule.
2. Whether the rule actually failed, retried, or skipped.
3. Tables receiving SentinelHealth records.
4. Time range and ingestion delay.
5. Whether the workspace is on the latest unified portal behavior.
If the docs say a retry should be logged but you cannot reproduce that, I would file feedback on the docs and include a minimal repro rule. For monitoring, build a fallback query around rule last-run status if retry events are not reliable.