Telemetry Validation: M365 & Azure Data Source
This hunting query verifies the availability and health of critical Microsoft 365, Azure, and Defender data sources that are essential for visibility in the case of incident response. Ensuring these log sources are active is fundamental for maintaining readiness to conduct full-scope investigations when an incident occurs without data loss or visibility gaps. The query enumerates all key log tables within the Log Analytics workspace and checks whether they: Are present and actively ingesting data (logs seen within the last 7 days) Are stale (no new events within the last 7 days) Are missing entirely, indicating the data connector is disabled or misconfigured The output provides a quick health status (✅ Active, ⚠️ Stale, or ❌ Missing) for each core log source
Microsoft Sentinel (KQL)
