Microsoft Entra Suite Tech Accelerator
Aug 14 2024, 07:00 AM - 09:30 AM (PDT)
Microsoft Tech Community

New Blog Post | Alert When Microsoft Sentinel Daily Ingestion Reaches a Threshold

Brass Contributor

Download.PNG

Alert When Microsoft Sentinel Daily Ingestion Reaches a Threshold - Azure Cloud & AI Domain Blog (az...

 

I just wanted to take a quick moment to highlight the efforts of a community member and to make everyone aware of this potential solution.

 

Ashok Krishna Vemuri wrote a KQL query that reports when the daily data ingestion volume is more than 200GB. This number can be modified to fit your needs and can be used in an Analytics Rules with automation (Playbook, Automation Rule) to send an alert through email, text, or any means to the team responsible for monitoring ingestion and costs.

 

The query is located here: https://github.com/le0li9ht/Microsoft-Sentinel-Queries/blob/main/SuddenSpikeInDataIngestion.kql

0 Replies