Find centralized, trusted content and collaborate around the technologies you use most.
Teams
Q&A for work
Connect and share knowledge within a single location that is structured and easy to search.
我正在尝试创建一个警报,让我知道数据源是否停止向 Sentinel 提供日志。虽然我知道它在仪表板上的日志数据中显示异常,但我希望在来源长时间停止提供日志时收到警报。
类似于使用以下查询创建规则(在本例中为 CEF):
CommonSecurityLog | where TimeGenerated > ago(24h) | summarize count() by DeviceVendor, DeviceProduct, DeviceName, DeviceExternalID | where count_ == 0