Question

Your SOC relies on several Microsoft Sentinel data connectors, including a Syslog/CEF connector from a Linux forwarder and a custom REST API poller. Last week, ingestion from the forwarder silently stopped for 18 hours before an analyst noticed missing logs. Management wants proactive alerting when any connector stops sending data or when ingestion latency spikes, using built-in capabilities without writing custom KQL from scratch. Which approach should you implement?

Accepted Answer

Enable the Sentinel health monitoring feature and connect the SentinelHealth and related health tables, then create scheduled analytics rules or use the Data collection health monitoring workbook to alert on connector failures and latency.

Answer

Increase the data retention period on the affected tables so that any gaps in ingestion are automatically backfilled once the forwarder reconnects.

Answer

Configure an automation rule that triggers a playbook every hour to restart the Linux forwarder service regardless of its current status.

Answer

Switch all connectors to Near-Real-Time (NRT) analytics rules, since NRT rules automatically detect when no events arrive within the expected window.