medium10 pts · first answer countssiemmicrosoft-sentinelkql
Finding agents that stopped reporting
Which query lists machines whose agent has not sent a heartbeat for over an hour?
Heartbeat | summarize LastSeen = max(TimeGenerated) by Computer | where LastSeen < ago(1h)
Discussion 0
Join free to post in the discussion.
Related questions
- What stats count by does in SPLCybersecurity Analyst
- Grouping with summarize in KQLCybersecurity Analyst
- Why logs go to a SIEMCybersecurity Analyst
- Why normalise to a common schemaCybersecurity Analyst
- What a SIEM is forCybersecurity Analyst
- What a Splunk index isCybersecurity Analyst
- What sourcetype tells SplunkCybersecurity Analyst
- The Splunk Universal ForwarderCybersecurity Analyst