Health Checks
analytics-rule-health.kql
Analytics Rules that ran successfully in the last 90 days but never produced an alert — candidates for review or tuning.
// Author: Ian D. Hanley (DevSecOpsDad) | linkedin.com/in/ianhanley | devsecopsdad.com | devsecopsdadattack.com
let activeRules = SentinelHealth
| where TimeGenerated >= ago(90d)
| where SentinelResourceType == "Analytics Rule" and Status == "Success"
| summarize by SentinelResourceName;
let alertingRules = SecurityAlert
| where TimeGenerated >= ago(90d)
| distinct AlertName;
activeRules
| where SentinelResourceName !in (alertingRules)