Agent Foskett Case File • Microsoft Sentinel • Data Connectors • SentinelHealth • Data Ingestion • KQL
The Sentinel Connector Was Green — But the Events Had Stopped
The connector looked fine.
Configured.
Connected.
No obvious warning demanding attention.
But an analyst hunting through the expected security data noticed something strange.
The newest events were hours old.
The connector still existed.
The workspace still worked.
The queries still ran.
Only the evidence had stopped arriving.
Agent Foskett asked a question every SOC should ask regularly.
Are we monitoring the connector — or are we monitoring the data?
Connected Did Not Mean Current.
A configured connector is only part of the story. Detection depends on the expected data continuing to reach the workspace.
✓ Check data freshness
✓ Inspect SentinelHealth
✓ Define the missing-data window
The first clue was absence
There was no dramatic alert telling the SOC that evidence had disappeared.
The clue was simply that a table which normally received frequent events had gone quiet.
That made this a different kind of investigation.
Agent Foskett was investigating something that should have happened — but did not.
The clue was simply that a table which normally received frequent events had gone quiet.
That made this a different kind of investigation.
Agent Foskett was investigating something that should have happened — but did not.
Start with the data, not the connector page
Before troubleshooting configuration, Agent Foskett established the most important fact: when had the target table last received an event?
For this case, the affected source was Microsoft 365 audit data flowing into
The same principle applies to any expected table: identify its normal cadence and compare that with the newest available event.
For this case, the affected source was Microsoft 365 audit data flowing into
OfficeActivity.The same principle applies to any expected table: identify its normal cadence and compare that with the newest available event.
Find the newest event
Agent Foskett first measured event freshness using the source event timestamp. A quiet table may be legitimate, so the result had to be compared with the source's normal activity pattern.
- 1
- 2
- 3
- 4
- 5
- 6
- 7
OfficeActivity
| summarize LastEventTime = max(TimeGenerated),
EventsLastHour = countif(TimeGenerated > ago(1h)),
EventsLast24Hours = countif(TimeGenerated > ago(24h))
| extend EventAge = now() - LastEventTimeThe table had stopped moving
The latest event was far older than the workload's normal cadence.
That did not yet explain why.
It established the gap.
Before diagnosing a connector problem, prove that the expected data is actually stale.
That did not yet explain why.
It established the gap.
Before diagnosing a connector problem, prove that the expected data is actually stale.
Separate event time from ingestion time
A source can deliver events late. Agent Foskett therefore compared
TimeGenerated with ingestion_time() to distinguish stale source events from delayed ingestion into the workspace.- 1
- 2
- 3
- 4
- 5
- 6
- 7
- 8
- 9
OfficeActivity
| where TimeGenerated > ago(7d)
| extend IngestionTime = ingestion_time(),
IngestionDelay = ingestion_time() - TimeGenerated
| summarize LastEventTime = max(TimeGenerated),
LastIngestionTime = max(IngestionTime),
P95Delay = percentile(IngestionDelay, 95),
P99Delay = percentile(IngestionDelay, 99)Freshness and delay are different problems
If recent source events exist but arrive late, the investigation is about ingestion delay.
If neither recent event timestamps nor recent ingestion timestamps exist, the collection path may have stalled entirely.
“No current events” and “current events arriving late” are not the same failure.
If neither recent event timestamps nor recent ingestion timestamps exist, the collection path may have stalled entirely.
“No current events” and “current events arriving late” are not the same failure.
Now inspect Sentinel's own health evidence
Microsoft Sentinel can write health events for supported data connectors to
Microsoft recommends monitoring connector health, connectivity and performance, and provides both the Data collection health monitoring workbook and health-table queries for this purpose.
Agent Foskett used that evidence as another layer — not as a replacement for checking the target data itself.
SentinelHealth when auditing and health monitoring is enabled.Microsoft recommends monitoring connector health, connectivity and performance, and provides both the Data collection health monitoring workbook and health-table queries for this purpose.
Agent Foskett used that evidence as another layer — not as a replacement for checking the target data itself.
Check recent connector health
For supported connectors, health events can show data-fetch status changes and failures. Agent Foskett retrieved the latest health record per connector and looked specifically for failure states.
- 1
- 2
- 3
- 4
- 5
- 6
- 7
- 8
- 9
- 10
- 11
- 12
- 13
- 14
SentinelHealth
| where TimeGenerated > ago(3d)
| where OperationName == "Data fetch status change"
| where Status in ("Success", "Failure")
| summarize arg_max(TimeGenerated, *) by SentinelResourceName, SentinelResourceId
| project TimeGenerated,
SentinelResourceName,
SentinelResourceId,
Status,
Description,
ExtendedProperties
| order by TimeGenerated descA healthy-looking state was not enough
Connector health telemetry is valuable, but Microsoft Sentinel health monitoring does not cover every connector in exactly the same way, and a configuration or status view is not the same measurement as the freshness of the security events your detections depend on.
Agent Foskett therefore kept two questions separate.
Is the connector reporting a problem?
and
Is the expected data actually arriving?
Agent Foskett therefore kept two questions separate.
Is the connector reporting a problem?
and
Is the expected data actually arriving?
Build a simple data-freshness monitor
Agent Foskett created a straightforward freshness check for the affected table. The threshold must be chosen from the source's expected event frequency; a rarely used source should not share the same threshold as a high-volume workload.
- 1
- 2
- 3
- 4
- 5
- 6
- 7
- 8
let MaximumExpectedSilence = 30m;
OfficeActivity
| summarize LastEventTime = max(TimeGenerated)
| extend EventAge = now() - LastEventTime
| extend FreshnessState =
iff(EventAge > MaximumExpectedSilence, "STALE", "CURRENT")Thresholds need a baseline
Thirty minutes might be alarming for a source that normally produces events every minute.
It could be meaningless for a source that legitimately produces one event per day.
Agent Foskett reviewed historical event volume and cadence before deciding what “stopped” should mean operationally.
Missing-data detection needs an expected heartbeat.
It could be meaningless for a source that legitimately produces one event per day.
Agent Foskett reviewed historical event volume and cadence before deciding what “stopped” should mean operationally.
Missing-data detection needs an expected heartbeat.
See the normal ingestion pattern
A time series made the gap easier to see and helped distinguish a real collection break from a naturally quiet period.
- 1
- 2
- 3
- 4
- 5
- 6
OfficeActivity | where TimeGenerated > ago(7d) | summarize Events = count() by bin(TimeGenerated, 1h) | order by TimeGenerated asc
The outage window mattered more than the colour
Once the last reliable event was known, Agent Foskett defined the missing-data window.
Every analytics rule, hunting query and investigation relying on that source during the gap had potentially operated with incomplete visibility.
The connector problem therefore became a detection-coverage problem.
When telemetry stops, the question is not only “how do we restore it?” It is also “what could we not see while it was gone?”
Every analytics rule, hunting query and investigation relying on that source during the gap had potentially operated with incomplete visibility.
The connector problem therefore became a detection-coverage problem.
When telemetry stops, the question is not only “how do we restore it?” It is also “what could we not see while it was gone?”
Restore collection — then validate it
After the collection issue was corrected, Agent Foskett did not stop when the connector appeared healthy again.
He returned to the target table.
Were new events arriving?
Were timestamps current?
Was ingestion delay back within the expected range?
Had the historical gap been backfilled, or did it remain permanent?
Recovery is proven by data, not by configuration alone.
He returned to the target table.
Were new events arriving?
Were timestamps current?
Was ingestion delay back within the expected range?
Had the historical gap been backfilled, or did it remain permanent?
Recovery is proven by data, not by configuration alone.
Build the missing-data timeline
Events flowing normallyThe source produces security data at its expected cadence.
Collection gap beginsExpected events stop reaching the workspace.
Connector still appears configuredNo obvious visual clue immediately explains the missing telemetry.
Freshness check exposes the gapKQL shows the newest event is older than the source's normal heartbeat.
Health evidence investigatedSentinelHealth and connector diagnostics are reviewed where supported.
Collection restored and verifiedNew source events and ingestion timestamps prove that visibility has returned.
What Agent Foskett checked
Last event timeWhen did the source last produce evidence visible in the workspace?
Last ingestion timeWhen did the workspace last ingest data from the affected table?
Ingestion delayWere events missing completely or simply arriving late?
SentinelHealthDid supported connector health telemetry record a failure or state change?
Normal cadenceHow much silence is genuinely abnormal for this data source?
Detection exposureWhich rules and investigations relied on the missing telemetry during the gap?
What the evidence can and cannot prove
A stale target table proves that expected recent data is absent only when the source normally should have produced events during that period.
No single status indicator replaces validation of the telemetry your detections actually consume.
ingestion_time() helps distinguish source event time from workspace ingestion time.SentinelHealth can provide health evidence for supported Sentinel resources when health monitoring is enabled, but Microsoft documents connector-specific support and limitations.No single status indicator replaces validation of the telemetry your detections actually consume.
The lesson
The connector existed.
The workspace was online.
The queries still worked.
And yet the SOC had lost visibility into part of the environment.
A connector can look reassuring while the data tells a different story.
Agent Foskett stopped looking at the colour of the connector and measured the age of the evidence.
The workspace was online.
The queries still worked.
And yet the SOC had lost visibility into part of the environment.
A connector can look reassuring while the data tells a different story.
Agent Foskett stopped looking at the colour of the connector and measured the age of the evidence.
Investigation principle: Monitor data freshness as well as connector health. The security control you depend on is not the connector object — it is the continuous arrival of usable telemetry.
Related investigations
Agent Foskett InvestigationsContinue through the complete collection of real-world Microsoft security investigations.KQL Threat HuntingUse KQL to investigate identity, endpoint, cloud and telemetry evidence.SOC Analyst AcademyBuild practical investigation, monitoring and detection-engineering skills.
Final thought
Security teams spend enormous effort deciding what suspicious activity looks like.
But sometimes the most important signal is silence.
No events.
No fresh records.
No evidence where evidence should exist.
Agent Foskett did not trust the connector's appearance. He asked the data when it had last spoken.
The Logs Already Knew! 🔎
But sometimes the most important signal is silence.
No events.
No fresh records.
No evidence where evidence should exist.
Agent Foskett did not trust the connector's appearance. He asked the data when it had last spoken.
The Logs Already Knew! 🔎
