KQL - Unused Microsoft Sentinel Analytics Rule Finder
Identifies Microsoft Sentinel scheduled analytics rules that have executed successfully over a specified period but have never produced any query results. The query reviews Microsoft Sentinel health telemetry and highlights rules that consistently execute without generating matching events. These rules may represent outdated detections, unused content, environmental mismatches, incorrect data source assumptions, or opportunities for detection engineering review. This query helps SOC and detection engineering teams reduce maintenance overhead, improve content quality, and identify candidates for retirement or redesign.
Microsoft Sentinel (KQL)
