Monitoring automation rules and playbook health
Microsoft Sentinel automation has a native way of monitoring the health of automation rules and playbook triggers. This monitoring can be enabled from the Settings page of Microsoft Sentinel, under Health monitoring.
Figure 5.42 – Microsoft Sentinel – Health Monitoring configuration
We need to enable the Automation diagnostic settings and send them to the Log Analytics workspace where Microsoft Sentinel is enabled.
Figure 5.43 – The Automation Health monitoring configuration wizard
These diagnostic settings will be saved in the SentinelHealth table in Microsoft Sentinel so that we can query statuses using KQL.
A sample KQL query that you can use to get this data is as follows:
SentinelHealth
| where SentinelResourceType in ("Playbook", "Automation rule")
Figure 5.44 – Querying the SentinelHealth table in the Microsoft...
