Marvens Decayette
@IronBrandedCompletionist
1 follower50 downloads396 copies10 likes3,286 views
11 detections
Filters
Last updated
All Time
Detection languages
7
4
Categories
2
1
1
1
1
Platforms
6
Products / Services
1
1
1
MITRE Techniques
2
1
1
1
1
IDS Classtypes
1
This hunting query verifies the availability and health of critical Microsoft 365, Azure, and Defender data sources that are essential for visibility in the case of incident response.
Ensuring these log sources are active is fundamental for maintaining readiness to conduct full-scope investigations when an incident occurs without data loss or visibility gaps.
The query enumerates all key log tables within the Log Analytics workspace and checks whether they:
Are present and actively ingesting data (logs seen within the last 7 days)
Are stale (no new events within the last 7 days)
Are missing entirely, indicating the data connector is disabled or misconfigured
The output provides a quick health status (✅ Active, ⚠️ Stale, or ❌ Missing) for each core log source
Ensuring these log sources are active is fundamental for maintaining readiness to conduct full-scope investigations when an incident occurs without data loss or visibility gaps.
The query enumerates all key log tables within the Log Analytics workspace and checks whether they:
Are present and actively ingesting data (logs seen within the last 7 days)
Are stale (no new events within the last 7 days)
Are missing entirely, indicating the data connector is disabled or misconfigured
The output provides a quick health status (✅ Active, ⚠️ Stale, or ❌ Missing) for each core log source
Page 2 of 2