You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: articles/sentinel/enable-monitoring.md
+2-7Lines changed: 2 additions & 7 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -4,7 +4,7 @@ description: Monitor supported data connectors by using the SentinelHealth data
4
4
author: batamig
5
5
ms.author: bagol
6
6
ms.topic: how-to
7
-
ms.date: 10/17/2024
7
+
ms.date: 08/24/2025
8
8
appliesto:
9
9
- Microsoft Sentinel in the Microsoft Defender portal
10
10
- Microsoft Sentinel in the Azure portal
@@ -13,19 +13,14 @@ appliesto:
13
13
14
14
---
15
15
16
-
# Turn on auditing and health monitoring for Microsoft Sentinel (preview)
16
+
# Turn on auditing and health monitoring for Microsoft Sentinel
17
17
18
18
Monitor the health and audit the integrity of supported Microsoft Sentinel resources by turning on the auditing and health monitoring feature in Microsoft Sentinel's **Settings** page. Get insights on health drifts, such as the latest failure events or changes from success to failure states, and on unauthorized actions, and use this information to create notifications and other automated actions.
19
19
20
20
To get health data from the [*SentinelHealth*](health-table-reference.md) data table, or to get auditing information from the [*SentinelAudit*](audit-table-reference.md) data table, you must first turn on the Microsoft Sentinel auditing and health monitoring feature for your workspace. This article instructs you how to turn on these features.
21
21
22
22
To implement the health and audit feature using API (Bicep/AZURE RESOURCE MANAGER (ARM)/REST), review the [Diagnostic Settings operations](/rest/api/monitor/diagnostic-settings). To configure the retention time for your audit and health events, see [Manage data retention in a Log Analytics workspace](/azure/azure-monitor/logs/data-retention-configure).
23
23
24
-
> [!IMPORTANT]
25
-
>
26
-
> The *SentinelHealth* and *SentinelAudit* data tables are currently in **PREVIEW**. See the [Supplemental Terms of Use for Microsoft Azure Previews](https://azure.microsoft.com/support/legal/preview-supplemental-terms/) for additional legal terms that apply to Azure features that are in beta, preview, or otherwise not yet released into general availability.
27
-
>
28
-
29
24
## Prerequisites
30
25
31
26
- Before you start, learn more about health monitoring and auditing in Microsoft Sentinel. For more information, see [Auditing and health monitoring in Microsoft Sentinel](health-audit.md).
Copy file name to clipboardExpand all lines: articles/sentinel/health-audit.md
+3-8Lines changed: 3 additions & 8 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -4,14 +4,14 @@ description: Learn about the Microsoft Sentinel health and audit feature, which
4
4
author: batamig
5
5
ms.author: bagol
6
6
ms.topic: concept-article
7
-
ms.date: 08/04/2024
7
+
ms.date: 08/24/2025
8
8
9
9
10
10
#Customer intent: As a security analyst, I want to monitor and audit Microsoft Sentinel's health and activity so that I can ensure the service is functioning correctly and detect any unauthorized actions.
11
11
12
12
---
13
13
14
-
# Auditing and health monitoring in Microsoft Sentinel
14
+
# Auditing and health monitoring in Microsoft Sentinel
15
15
16
16
Microsoft Sentinel is a critical service for advancing and protecting the security of your organization’s technological and information assets, so you want to be sure that it's always running smoothly and free of interference.
17
17
@@ -36,11 +36,6 @@ The most common way you use this data is by querying these tables. For best resu
36
36
37
37
The *SentinelHealth* table isn't billable and incurs no charges for ingesting health data. The *SentinelAudit* table is billable, and as in other areas of Microsoft Sentinel, costs incurred depend on the log volume, which might be affected by the number of activities and changes made on related rules. For more information, see [Plan costs and understand Microsoft Sentinel pricing and billing](billing.md).
38
38
39
-
> [!IMPORTANT]
40
-
>
41
-
> The *SentinelHealth* and *SentinelAudit* data tables are currently in **PREVIEW**. See the [Supplemental Terms of Use for Microsoft Azure Previews](https://azure.microsoft.com/support/legal/preview-supplemental-terms/) for additional legal terms that apply to Azure features that are in beta, preview, or otherwise not yet released into general availability.
42
-
>
43
-
44
39
### Questions to verify service health and audit data
45
40
46
41
Use the following questions to guide your monitoring of Microsoft Sentinel's health and audit data:
@@ -80,4 +75,4 @@ To start collecting health and audit data, you need to [enable health and audit
80
75
-[Monitor the health of your data connectors](monitor-data-connector-health.md)
81
76
-[Monitor the health and integrity of your analytics rules](monitor-analytics-rule-integrity.md)
82
77
-[Monitor SAP system health](monitor-sap-system-health.md)
83
-
- The [*SentinelHealth*](health-table-reference.md) and [*SentinelAudit*](audit-table-reference.md) table schemas.
78
+
- The [*SentinelHealth*](health-table-reference.md) and [*SentinelAudit*](audit-table-reference.md) table schemas
Copy file name to clipboardExpand all lines: articles/sentinel/health-table-reference.md
+1-6Lines changed: 1 addition & 6 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -4,7 +4,7 @@ description: Learn about the fields in the SentinelHealth tables, used for healt
4
4
author: batamig
5
5
ms.author: bagol
6
6
ms.topic: reference
7
-
ms.date: 01/17/2023
7
+
ms.date: 08/20/2025
8
8
ms.service: microsoft-sentinel
9
9
10
10
@@ -21,11 +21,6 @@ Learn how to query and use the health table for deeper monitoring and visibility
21
21
- For [automation rules and playbooks](monitor-automation-health.md)
22
22
- For [analytics rules](monitor-analytics-rule-integrity.md)
23
23
24
-
> [!IMPORTANT]
25
-
>
26
-
> The *SentinelHealth* data table is currently in **PREVIEW**. See the [Supplemental Terms of Use for Microsoft Azure Previews](https://azure.microsoft.com/support/legal/preview-supplemental-terms/) for additional legal terms that apply to Azure features that are in beta, preview, or otherwise not yet released into general availability.
27
-
>
28
-
29
24
Microsoft Sentinel's health monitoring feature covers different kinds of resources (see the resource types in the **SentinelResourceType** field in the first table below). Many of the data fields in the following tables apply across resource types, but some have specific applications for each type. The descriptions below will indicate one way or the other.
Copy file name to clipboardExpand all lines: articles/sentinel/monitor-analytics-rule-integrity.md
+2-5Lines changed: 2 additions & 5 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -4,7 +4,7 @@ description: Use the SentinelHealth data table to keep track of your analytics r
4
4
author: yelevin
5
5
ms.author: yelevin
6
6
ms.topic: conceptual
7
-
ms.date: 02/20/2023
7
+
ms.date: 08/24/2025
8
8
9
9
10
10
#Customer intent: As a security analyst, I want to monitor and audit the health and integrity of my analytics rules so that I can ensure uninterrupted and tampering-free threat detection.
@@ -21,9 +21,6 @@ This article describes how to use Microsoft Sentinel's [auditing and health moni
21
21
22
22
For information on rule insights and manual rerunning of rules, see [Monitor and optimize the execution of your scheduled analytics rules](monitor-optimize-analytics-rule-execution.md).
23
23
24
-
> [!IMPORTANT]
25
-
>
26
-
> The *SentinelHealth* and *SentinelAudit* data tables are currently in **PREVIEW**. See the [Supplemental Terms of Use for Microsoft Azure Previews](https://azure.microsoft.com/support/legal/preview-supplemental-terms/) for additional legal terms that apply to Azure features that are in beta, preview, or otherwise not yet released into general availability.
27
24
28
25
## Summary
29
26
@@ -48,7 +45,7 @@ For information on rule insights and manual rerunning of rules, see [Monitor and
48
45
49
46
These logs are collected in the *SentinelAudit* table in Log Analytics.
50
47
51
-
## Use the SentinelHealth and SentinelAudit data tables (Preview)
48
+
## Use the SentinelHealth and SentinelAudit data tables
52
49
53
50
To get audit and health data from the tables described above, you must first turn on the Microsoft Sentinel health feature for your workspace. For more information, see [Turn on auditing and health monitoring for Microsoft Sentinel](enable-monitoring.md).
Copy file name to clipboardExpand all lines: articles/sentinel/monitor-automation-health.md
+2-2Lines changed: 2 additions & 2 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -4,7 +4,7 @@ description: Use the SentinelHealth and AzureDiagnostics data tables to keep tra
4
4
author: batamig
5
5
ms.author: bagol
6
6
ms.topic: how-to
7
-
ms.date: 05/20/2024
7
+
ms.date: 08/20/2025
8
8
ms.service: microsoft-sentinel
9
9
10
10
@@ -20,7 +20,7 @@ Set up notifications of health events for relevant stakeholders, who can then ta
20
20
21
21
This article describes how to use Microsoft Sentinel's health monitoring features to keep track of your automation rules and playbooks's health from within Microsoft Sentinel. For more information, see [Auditing and health monitoring in Microsoft Sentinel](health-audit.md).
22
22
23
-
## Use the SentinelHealth data table (Public preview)
23
+
## Use the SentinelHealth data table
24
24
25
25
To get automation health data from the *SentinelHealth* data table, first turn on the Microsoft Sentinel health feature for your workspace. For more information, see [Turn on health monitoring for Microsoft Sentinel](enable-monitoring.md).
Copy file name to clipboardExpand all lines: articles/sentinel/monitor-data-connector-health.md
+4-8Lines changed: 4 additions & 8 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -4,7 +4,7 @@ description: Use the SentinelHealth data table and the Health Monitoring workboo
4
4
author: yelevin
5
5
ms.author: yelevin
6
6
ms.topic: how-to
7
-
ms.date: 10/17/2024
7
+
ms.date: 08/20/2025
8
8
ms.service: microsoft-sentinel
9
9
appliesto:
10
10
- Microsoft Sentinel in the Microsoft Defender portal
@@ -16,17 +16,13 @@ appliesto:
16
16
17
17
# Monitor the health of your data connectors
18
18
19
-
To ensure complete and uninterrupted data ingestion in your Microsoft Sentinel service, keep track of your data connectors' health, connectivity, and performance.
19
+
To ensure complete and uninterrupted data ingestion in your Microsoft Sentinel service, keep track of your data connectors' health, connectivity, and performance.
20
20
21
21
The following features allow you to perform this monitoring from within Microsoft Sentinel:
22
22
23
23
-**Data collection health monitoring workbook**: This workbook provides additional monitors, detects anomalies, and gives insight regarding the workspace’s data ingestion status. You can use the workbook’s logic to monitor the general health of the ingested data, and to build custom views and rule-based alerts.
24
24
25
-
-***SentinelHealth* data table (Preview)**: Querying this table provides insights on health drifts, such as latest failure events per connector, or connectors with changes from success to failure states, which you can use to create alerts and other automated actions. The *SentinelHealth* data table is currently supported only for [selected data connectors](#supported-data-connectors).
26
-
27
-
> [!IMPORTANT]
28
-
>
29
-
> The *SentinelHealth* data table is currently in **PREVIEW**. See the [Supplemental Terms of Use for Microsoft Azure Previews](https://azure.microsoft.com/support/legal/preview-supplemental-terms/) for additional legal terms that apply to Azure features that are in beta, preview, or otherwise not yet released into general availability.
25
+
-***SentinelHealth* data table**: Querying this table provides insights on health drifts, such as latest failure events per connector, or connectors with changes from success to failure states, which you can use to create alerts and other automated actions. The *SentinelHealth* data table is currently supported only for [selected data connectors](#supported-data-connectors).
30
26
31
27
-[**View the health and status of your connected SAP systems**](monitor-sap-system-health.md): Review health information for your SAP systems under the SAP data connector, and use an alert rule template to get information about the health of the SAP agent's data collection.
32
28
@@ -69,7 +65,7 @@ There are three tabbed sections in this workbook:
69
65
70
66
:::image type="content" source="media/monitor-data-connector-health/data-health-workbook-3.png" alt-text="data connector health monitoring workbook agent info page" lightbox="media/monitor-data-connector-health/data-health-workbook-3.png":::
71
67
72
-
## Use the SentinelHealth data table (Public preview)
68
+
## Use the SentinelHealth data table
73
69
74
70
To get data connector health data from the *SentinelHealth* data table, you must first turn on the Microsoft Sentinel health feature for your workspace. For more information, see [Turn on health monitoring for Microsoft Sentinel](enable-monitoring.md).
0 commit comments