Sentinel Data Connector Status Anomaly Detection
Detects anomalies in data connector log volumes by comparing current log counts to 30-day averages, identifying significant deviations. This query monitors the health and performance of data connectors feeding into Microsoft Sentinel by analyzing log volumes from various sources over the past 30 days. It calculates hourly averages to establish a baseline and compares these to logs from the last hour to identify significant deviations. Specifically, the query detects "No Logs" (indicating a complete halt in log transmission), "Critical Spike" and "Elevated Spike" (indicating significantly higher log volumes, suggesting potential security incidents or increased activity), and "Critical Drop" and "Elevated Drop" (indicating significantly lower log volumes, which could point to misconfigurations or data source issues). The query provides detailed alerts for these anomalies, helping administrators proactively address potential issues with data connectors.
Microsoft Sentinel (KQL)
