TLDR Tech / InfoSec
Seven Queries to Audit the Sentinel Detections Your SOC May Have Missed
Rohitashokgowd published seven KQL queries that surface the failure modes Sentinel's built-in health checks miss: silent zombie rules running successfully against empty tables (using the underused QueryResultAmount column in _SentinelHealth), shadow detectors generating alerts that never become incidents, "everything is benign" rules where analyst Classification data shows over 90% non-actionable closures, broken feeds where rules query tables that stopped ingesting, forgotten-disabled rules flagged via SentinelAudit, untracked detections missing MITRE tactics or entity mappings, and coverage drift where a MITRE technique's alert volume drops 60%+ between rolling 30-day windows. Three of the checks depend on a rule inventory pattern in which a scheduled Logic App pulls ARM analytics rule definitions into a custom Log Analytics table (SentinelAnalyticalRules_CL), so query text and metadata can be joined in KQL. Detection engineers should run these quarterly to catch the dangerous middle ground where rules are green, and data flows, but the detection pattern has stopped matching, then retire, retune, or redirect rules accordingly, rather than letting disabled rules and silent feeds masquerade as coverage.
Read the full story