Alerting when a connector stops sending logs

%3CLINGO-SUB%20id%3D%22lingo-sub-2674978%22%20slang%3D%22en-US%22%3EAlerting%20when%20a%20connector%20stops%20sending%20logs%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-2674978%22%20slang%3D%22en-US%22%3E%3CP%3EGreetings%2C%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EI%20have%20been%20looking%20around%20and%20I'm%20quite%20sure%20someone%20has%20asked%20for%20a%20way%20to%20generate%20an%20alert%20if%20one(or%20more)%20of%20the%20log%20sources(connectors)%20stop%20sending%20logs.%20However%2C%20i%20have%20not%20been%20able%20to%20find%20out%20if%20this%20got%20a%20solution%20or%20not.%20I%20think%20this%20should%20possibly%20be%20a%20part%20of%20Sentinel%20out%20of%20the%20box%2C%20but%20if%20anyone%20has%20a%20different%20solution%20i%20would%20much%20appreciate%20it.%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-2675271%22%20slang%3D%22en-US%22%3ERe%3A%20Alerting%20when%20a%20connector%20stops%20sending%20logs%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-2675271%22%20slang%3D%22en-US%22%3ESomething%20like%20this%3F%20%3CA%20href%3D%22https%3A%2F%2Fcda.ms%2F2qT%22%20target%3D%22_blank%22%20rel%3D%22nofollow%20noopener%20noreferrer%22%3Ehttps%3A%2F%2Fcda.ms%2F2qT%3C%2FA%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-2675304%22%20slang%3D%22en-US%22%3ERe%3A%20Alerting%20when%20a%20connector%20stops%20sending%20logs%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-2675304%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F324945%22%20target%3D%22_blank%22%3E%40rodtrent%3C%2FA%3E%26nbsp%3B%3C%2FP%3E%3CP%3EYes%2C%20or%20at%20least%20quite%20similar.%20Although%20i%20had%20hoped%20there%20was%20some%20solution%20that%20wouldn't%20require%20to%20make%20a%20new%20alert%20for%20each%20table%20i%20want%20to%20track.%20Something%20a%20bit%20more%20dynamic.%20But%20thanks%20for%20the%20answer%2C%20it%20will%20do%20fine%20for%20now%26nbsp%3B%3CIMG%20class%3D%22lia-deferred-image%20lia-image-emoji%22%20src%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Fhtml%2F%408341BD79091AF36AA2A09063B554B5CD%2Fimages%2Femoticons%2Fsmile_40x40.gif%22%20alt%3D%22%3Asmile%3A%22%20title%3D%22%3Asmile%3A%22%20%2F%3E%3C%2FP%3E%3C%2FLINGO-BODY%3E
Contributor

Greetings,

 

I have been looking around and I'm quite sure someone has asked for a way to generate an alert if one(or more) of the log sources(connectors) stop sending logs. However, i have not been able to find out if this got a solution or not. I think this should possibly be a part of Sentinel out of the box, but if anyone has a different solution i would much appreciate it. 

2 Replies
Something like this? https://cda.ms/2qT

@rodtrent 

Yes, or at least quite similar. Although i had hoped there was some solution that wouldn't require to make a new alert for each table i want to track. Something a bit more dynamic. But thanks for the answer, it will do fine for now :smile: