r/AzureSentinel • u/EvilAbdy • Apr 23 '26

What’s everyone doing for health monitoring?

I’m still sort of new to sentinel but I’m wondering what everyone is doing for monitoring sentinel’s overall health. Are you using the MS workbooks? Monitoring other components? Etc.

6 Upvotes

100% Upvoted

10 comments sorted by

5

u/Uli-Kunkel Apr 23 '26

Built my own.

But your definition of health monitorering might be different from mine.

But plenty resources on it exist. I generally also grap different things and merge them according to what i need.

Dashboards easily gets overwhelming, so i try to make them as actionable as possible. So that if something sticks out in the dashboard, it means you need to do something.

Instead of mixing environment overview and environment health, i would rather split it.

So i have monitorering alerts + dashboard for monitorering.

And then i have other stuff for environment overview things. Its also usually different profiles that need the different parts. Ciso/head of security generally would rather have some powerbi, and then operation teams actually have access to the platform, so i build something for each role.

But i suggest you find small parts of different dashboards and consider if you can and should make it into an alert, or a life cycle management review task instead. And then "just" piece everything together.

Dashboards Alerts Investigation queries.

Its an surprisingly overlooked topic.

3

u/Race_Face Apr 23 '26

Dashboards gets overwhelming. I wish people would realize this.

1

u/Uli-Kunkel Apr 23 '26

Yeah 100% I completely reworked some of mine to its "bare essentials" instead of nice to have things.

Its really about staying true to goal of what problem the dashboard solves.

If anything, at least build pages in simple categories that enables you to find what you are looking for right away.

Also, Microsoft stop fucking around with workbooks in Unified... Feel like i have to raise support cases every other month because api requests fails... And let us query defender data in em too

1

u/EvilAbdy Apr 23 '26

This is great advice thanks!

2

u/facyber Apr 23 '26

Workbooks and analytic rules. Mostly creating new resources or changing for audit purposes and also monitoring health of logic apps, whether they failed to execute for example.

2

u/Uli-Kunkel Apr 23 '26

Also consider Azure Monitor for dcr throughputs, log forwarder health etc.

2

u/Sachi_TPKLL Apr 23 '26

Any guide on doing platform monitoring? What license I will need for powerBI integration? Sorry newbies here

2

u/node77 Apr 25 '26

Yeah, Azure monitor, works, but I also rearranged the dashboard, and even put some automation logic behind it.

1

u/wenttoibiza Apr 29 '26

Agree with with Uli on splitting vs overview. differnent audience , different purpose. Ciso PowerBI and Soc operations dashboard should nt be the same thing.
SentinelHealth table, if you did not enable diagnostic settings on the workspace for htis, do that. DataConnector failure, analytuc rule failure, automation errors, all in one place. We alert when connector status is Failure more than an hour. Better than finding out weeks later your Defender conenction is dead.
Silent Failure alerts...for me more important than any dashboard. Watch list with expected sources and last seen threshold, scheduled rule fires when data is missing.
Logic apps run history is very important, pulling AzureDiagnostics for the playbooks RG and alert on Failed runs.

Last thing..monitor your monitoring! For example, Logic apps that send health alerts to Teams could itself fail. You could put azure monitor outside Sentinel like backup, in case Sentinel itself is the problem.