KQL Search

This query is designed to check if health monitoring is enabled for data connectors in Microsoft Sentinel over the past week. Here's a simple breakdown of what it does:

1. Data Source: It starts by looking at the SentinelHealth table, which contains health-related information for Microsoft Sentinel resources.

2. Time Filter: It filters the data to only include records from the last 7 days (TimeGenerated > ago(7d)).

3. Resource Type Filter: It further narrows down the data to entries related to "Data connector" resources (SentinelResourceType contains "Data connector").

4. Operation Filter: It looks for operations where the data fetch status has changed (OperationName == "Data fetch status change").

5. Latest Status: It summarizes the data to get the most recent entry for each data connector (arg_max(TimeGenerated, *) by SentinelResourceName).

6. Success Filter: It only keeps records where the status of the data fetch operation is "Success" (where Status == "Success").

7. Projection: Finally, it selects and displays specific columns: the name of the data connector (SentinelResourceName), the status (Status), the time of the status change (TimeGenerated), a description (Description), and any additional properties (ExtendedProperties).

In summary, this query checks for successful data fetch status changes for data connectors in Microsoft Sentinel within the past week, showing the most recent successful status for each connector.