Skip to content

Commit 609416b

Browse files
Merge pull request #304628 from MicrosoftDocs/main
Auto Publish – main to live - 2025-08-24 17:00 UTC
2 parents 60649cb + 9d535c3 commit 609416b

6 files changed

Lines changed: 14 additions & 36 deletions

articles/sentinel/enable-monitoring.md

Lines changed: 2 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,7 @@ description: Monitor supported data connectors by using the SentinelHealth data
44
author: batamig
55
ms.author: bagol
66
ms.topic: how-to
7-
ms.date: 10/17/2024
7+
ms.date: 08/24/2025
88
appliesto:
99
- Microsoft Sentinel in the Microsoft Defender portal
1010
- Microsoft Sentinel in the Azure portal
@@ -13,19 +13,14 @@ appliesto:
1313

1414
---
1515

16-
# Turn on auditing and health monitoring for Microsoft Sentinel (preview)
16+
# Turn on auditing and health monitoring for Microsoft Sentinel
1717

1818
Monitor the health and audit the integrity of supported Microsoft Sentinel resources by turning on the auditing and health monitoring feature in Microsoft Sentinel's **Settings** page. Get insights on health drifts, such as the latest failure events or changes from success to failure states, and on unauthorized actions, and use this information to create notifications and other automated actions.
1919

2020
To get health data from the [*SentinelHealth*](health-table-reference.md) data table, or to get auditing information from the [*SentinelAudit*](audit-table-reference.md) data table, you must first turn on the Microsoft Sentinel auditing and health monitoring feature for your workspace. This article instructs you how to turn on these features.
2121

2222
To implement the health and audit feature using API (Bicep/AZURE RESOURCE MANAGER (ARM)/REST), review the [Diagnostic Settings operations](/rest/api/monitor/diagnostic-settings). To configure the retention time for your audit and health events, see [Manage data retention in a Log Analytics workspace](/azure/azure-monitor/logs/data-retention-configure).
2323

24-
> [!IMPORTANT]
25-
>
26-
> The *SentinelHealth* and *SentinelAudit* data tables are currently in **PREVIEW**. See the [Supplemental Terms of Use for Microsoft Azure Previews](https://azure.microsoft.com/support/legal/preview-supplemental-terms/) for additional legal terms that apply to Azure features that are in beta, preview, or otherwise not yet released into general availability.
27-
>
28-
2924
## Prerequisites
3025

3126
- Before you start, learn more about health monitoring and auditing in Microsoft Sentinel. For more information, see [Auditing and health monitoring in Microsoft Sentinel](health-audit.md).

articles/sentinel/health-audit.md

Lines changed: 3 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -4,14 +4,14 @@ description: Learn about the Microsoft Sentinel health and audit feature, which
44
author: batamig
55
ms.author: bagol
66
ms.topic: concept-article
7-
ms.date: 08/04/2024
7+
ms.date: 08/24/2025
88

99

1010
#Customer intent: As a security analyst, I want to monitor and audit Microsoft Sentinel's health and activity so that I can ensure the service is functioning correctly and detect any unauthorized actions.
1111

1212
---
1313

14-
# Auditing and health monitoring in Microsoft Sentinel
14+
# Auditing and health monitoring in Microsoft Sentinel
1515

1616
Microsoft Sentinel is a critical service for advancing and protecting the security of your organization’s technological and information assets, so you want to be sure that it's always running smoothly and free of interference.
1717

@@ -36,11 +36,6 @@ The most common way you use this data is by querying these tables. For best resu
3636

3737
The *SentinelHealth* table isn't billable and incurs no charges for ingesting health data. The *SentinelAudit* table is billable, and as in other areas of Microsoft Sentinel, costs incurred depend on the log volume, which might be affected by the number of activities and changes made on related rules. For more information, see [Plan costs and understand Microsoft Sentinel pricing and billing](billing.md).
3838

39-
> [!IMPORTANT]
40-
>
41-
> The *SentinelHealth* and *SentinelAudit* data tables are currently in **PREVIEW**. See the [Supplemental Terms of Use for Microsoft Azure Previews](https://azure.microsoft.com/support/legal/preview-supplemental-terms/) for additional legal terms that apply to Azure features that are in beta, preview, or otherwise not yet released into general availability.
42-
>
43-
4439
### Questions to verify service health and audit data
4540

4641
Use the following questions to guide your monitoring of Microsoft Sentinel's health and audit data:
@@ -80,4 +75,4 @@ To start collecting health and audit data, you need to [enable health and audit
8075
- [Monitor the health of your data connectors](monitor-data-connector-health.md)
8176
- [Monitor the health and integrity of your analytics rules](monitor-analytics-rule-integrity.md)
8277
- [Monitor SAP system health](monitor-sap-system-health.md)
83-
- The [*SentinelHealth*](health-table-reference.md) and [*SentinelAudit*](audit-table-reference.md) table schemas.
78+
- The [*SentinelHealth*](health-table-reference.md) and [*SentinelAudit*](audit-table-reference.md) table schemas

articles/sentinel/health-table-reference.md

Lines changed: 1 addition & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,7 @@ description: Learn about the fields in the SentinelHealth tables, used for healt
44
author: batamig
55
ms.author: bagol
66
ms.topic: reference
7-
ms.date: 01/17/2023
7+
ms.date: 08/20/2025
88
ms.service: microsoft-sentinel
99

1010

@@ -21,11 +21,6 @@ Learn how to query and use the health table for deeper monitoring and visibility
2121
- For [automation rules and playbooks](monitor-automation-health.md)
2222
- For [analytics rules](monitor-analytics-rule-integrity.md)
2323

24-
> [!IMPORTANT]
25-
>
26-
> The *SentinelHealth* data table is currently in **PREVIEW**. See the [Supplemental Terms of Use for Microsoft Azure Previews](https://azure.microsoft.com/support/legal/preview-supplemental-terms/) for additional legal terms that apply to Azure features that are in beta, preview, or otherwise not yet released into general availability.
27-
>
28-
2924
Microsoft Sentinel's health monitoring feature covers different kinds of resources (see the resource types in the **SentinelResourceType** field in the first table below). Many of the data fields in the following tables apply across resource types, but some have specific applications for each type. The descriptions below will indicate one way or the other.
3025

3126
## SentinelHealth table columns schema

articles/sentinel/monitor-analytics-rule-integrity.md

Lines changed: 2 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,7 @@ description: Use the SentinelHealth data table to keep track of your analytics r
44
author: yelevin
55
ms.author: yelevin
66
ms.topic: conceptual
7-
ms.date: 02/20/2023
7+
ms.date: 08/24/2025
88

99

1010
#Customer intent: As a security analyst, I want to monitor and audit the health and integrity of my analytics rules so that I can ensure uninterrupted and tampering-free threat detection.
@@ -21,9 +21,6 @@ This article describes how to use Microsoft Sentinel's [auditing and health moni
2121

2222
For information on rule insights and manual rerunning of rules, see [Monitor and optimize the execution of your scheduled analytics rules](monitor-optimize-analytics-rule-execution.md).
2323

24-
> [!IMPORTANT]
25-
>
26-
> The *SentinelHealth* and *SentinelAudit* data tables are currently in **PREVIEW**. See the [Supplemental Terms of Use for Microsoft Azure Previews](https://azure.microsoft.com/support/legal/preview-supplemental-terms/) for additional legal terms that apply to Azure features that are in beta, preview, or otherwise not yet released into general availability.
2724

2825
## Summary
2926

@@ -48,7 +45,7 @@ For information on rule insights and manual rerunning of rules, see [Monitor and
4845

4946
These logs are collected in the *SentinelAudit* table in Log Analytics.
5047

51-
## Use the SentinelHealth and SentinelAudit data tables (Preview)
48+
## Use the SentinelHealth and SentinelAudit data tables
5249

5350
To get audit and health data from the tables described above, you must first turn on the Microsoft Sentinel health feature for your workspace. For more information, see [Turn on auditing and health monitoring for Microsoft Sentinel](enable-monitoring.md).
5451

articles/sentinel/monitor-automation-health.md

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,7 @@ description: Use the SentinelHealth and AzureDiagnostics data tables to keep tra
44
author: batamig
55
ms.author: bagol
66
ms.topic: how-to
7-
ms.date: 05/20/2024
7+
ms.date: 08/20/2025
88
ms.service: microsoft-sentinel
99

1010

@@ -20,7 +20,7 @@ Set up notifications of health events for relevant stakeholders, who can then ta
2020

2121
This article describes how to use Microsoft Sentinel's health monitoring features to keep track of your automation rules and playbooks's health from within Microsoft Sentinel. For more information, see [Auditing and health monitoring in Microsoft Sentinel](health-audit.md).
2222

23-
## Use the SentinelHealth data table (Public preview)
23+
## Use the SentinelHealth data table
2424

2525
To get automation health data from the *SentinelHealth* data table, first turn on the Microsoft Sentinel health feature for your workspace. For more information, see [Turn on health monitoring for Microsoft Sentinel](enable-monitoring.md).
2626

articles/sentinel/monitor-data-connector-health.md

Lines changed: 4 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,7 @@ description: Use the SentinelHealth data table and the Health Monitoring workboo
44
author: yelevin
55
ms.author: yelevin
66
ms.topic: how-to
7-
ms.date: 10/17/2024
7+
ms.date: 08/20/2025
88
ms.service: microsoft-sentinel
99
appliesto:
1010
- Microsoft Sentinel in the Microsoft Defender portal
@@ -16,17 +16,13 @@ appliesto:
1616

1717
# Monitor the health of your data connectors
1818

19-
To ensure complete and uninterrupted data ingestion in your Microsoft Sentinel service, keep track of your data connectors' health, connectivity, and performance.
19+
To ensure complete and uninterrupted data ingestion in your Microsoft Sentinel service, keep track of your data connectors' health, connectivity, and performance.
2020

2121
The following features allow you to perform this monitoring from within Microsoft Sentinel:
2222

2323
- **Data collection health monitoring workbook**: This workbook provides additional monitors, detects anomalies, and gives insight regarding the workspace’s data ingestion status. You can use the workbook’s logic to monitor the general health of the ingested data, and to build custom views and rule-based alerts.
2424

25-
- ***SentinelHealth* data table (Preview)**: Querying this table provides insights on health drifts, such as latest failure events per connector, or connectors with changes from success to failure states, which you can use to create alerts and other automated actions. The *SentinelHealth* data table is currently supported only for [selected data connectors](#supported-data-connectors).
26-
27-
> [!IMPORTANT]
28-
>
29-
> The *SentinelHealth* data table is currently in **PREVIEW**. See the [Supplemental Terms of Use for Microsoft Azure Previews](https://azure.microsoft.com/support/legal/preview-supplemental-terms/) for additional legal terms that apply to Azure features that are in beta, preview, or otherwise not yet released into general availability.
25+
- ***SentinelHealth* data table**: Querying this table provides insights on health drifts, such as latest failure events per connector, or connectors with changes from success to failure states, which you can use to create alerts and other automated actions. The *SentinelHealth* data table is currently supported only for [selected data connectors](#supported-data-connectors).
3026

3127
- [**View the health and status of your connected SAP systems**](monitor-sap-system-health.md): Review health information for your SAP systems under the SAP data connector, and use an alert rule template to get information about the health of the SAP agent's data collection.
3228

@@ -69,7 +65,7 @@ There are three tabbed sections in this workbook:
6965

7066
:::image type="content" source="media/monitor-data-connector-health/data-health-workbook-3.png" alt-text="data connector health monitoring workbook agent info page" lightbox="media/monitor-data-connector-health/data-health-workbook-3.png":::
7167

72-
## Use the SentinelHealth data table (Public preview)
68+
## Use the SentinelHealth data table
7369

7470
To get data connector health data from the *SentinelHealth* data table, you must first turn on the Microsoft Sentinel health feature for your workspace. For more information, see [Turn on health monitoring for Microsoft Sentinel](enable-monitoring.md).
7571

0 commit comments

Comments
 (0)