Merge pull request #275724 from batamig/may-fixes

Sentinel May freshness

Author: v-ccolin

articles/sentinel/get-visibility.md

@@ -3,13 +3,15 @@ title: Visualize collected data
 description: Learn how to quickly view and monitor what's happening across your environment by using Microsoft Sentinel.
 author: yelevin
 ms.topic: how-to
-ms.date: 06/07/2023
+ms.date: 05/19/2024
 ms.author: yelevin
 ---
 
 # Visualize collected data
 
-In this article, you will learn how to quickly be able to view and monitor what's happening across your environment using Microsoft Sentinel. After you connected your data sources to Microsoft Sentinel, you get instant visualization and analysis of data so that you can know what's happening across all your connected data sources. Microsoft Sentinel gives you workbooks that provide you with the full power of tools already available in Azure as well as tables and charts that are built in to provide you with analytics for your logs and queries. You can either use workbook templates or create a new workbook easily, from scratch or based on an existing workbook. 
+In this article, you will learn how to quickly be able to view and monitor what's happening across your environment using Microsoft Sentinel. 
+
+After you connected your data sources to Microsoft Sentinel, you get instant visualization and analysis of data so that you can know what's happening across all your connected data sources. Microsoft Sentinel gives you workbooks that provide you with the full power of tools already available in Azure as well as tables and charts that are built in to provide you with analytics for your logs and queries. You can either use workbook templates or create a new workbook easily, from scratch or based on an existing workbook.
 
 ## Get visualization
 
@@ -38,10 +40,24 @@ You see different types of automation data under **Automation**.
 
 :::image type="content" source="./media/qs-get-visibility/automation.png" alt-text="Screenshot of the Automation section in the Microsoft Sentinel Overview page." lightbox="./media/qs-get-visibility/automation.png":::
 
-- At the top, you see a summary of the automation rules activity: Incidents closed by automation, the time the automation saved, and related playbooks health. 
+- At the top, you see a summary of the automation rules activity: Incidents closed by automation, the time the automation saved, and related playbooks health.
+
+   Microsoft Sentinel calculates the time saved by automation by finding the average time that a single automation saved, multiplied by the number of incidents that were resolved by automation. The formula is as follows:
+
+   `(avgWithout - avgWith) * resolvedByAutomation`
+
+   Where:
+
+   - **avgWithout** is the average time it takes for an incident to be resolved without automation.
+   - **avgWith** is the average time it takes for an incident to be resolved by automation.
+   - **resolvedByAutomation** is the number of incidents that are resolved by automation.
+
+
 - Below the summary, a graph summarizes the numbers of actions performed by automation, by type of action. 
+
 - At the bottom, you can find a count of the active automation rules with a link to the automation blade. 
 
+
 ### View status of data records, data collectors, and threat intelligence
 
 You see different types of data on data records, data collectors, and threat intelligence under **Data**.
@@ -68,10 +84,10 @@ Workbook templates provide integrated data from your connected data sources to l
 2. Search for a specific workbook to see the whole list and description of what each offers. 
 3. Assuming you use Microsoft Entra ID, to get up and running with Microsoft Sentinel, we recommend that you install the Microsoft Entra solution for Microsoft Sentinel and use the following workbooks:
    - **Microsoft Entra ID**: Use either or both of the following:
-       - **Microsoft Entra sign-ins** analyzes sign-ins over time to see if there are anomalies. This workbooks provides failed sign-ins by applications, devices, and locations so that you can notice, at a glance if something unusual happens. Pay attention to multiple failed sign-ins. 
+       - **Microsoft Entra sign-ins** analyzes sign-ins over time to see if there are anomalies. This workbook provides failed sign-ins by applications, devices, and locations so that you can notice, at a glance if something unusual happens. Pay attention to multiple failed sign-ins. 
        - **Microsoft Entra audit logs** analyzes admin activities, such as changes in users (add, remove, etc.), group creation, and modifications.  
 
-   - Install the appropriate solution to add a workbook for your firewall. For example, install the Palo Alto firewall solution for Microsoft Sentinel to add the Palo Alto workbooks. The workbooks analyze your firewall traffic, providing you with correlations between your firewall data and threat events, and highlights suspicious events across entities. Workbooks provide you with information about trends in your traffic and let you drill down into and filter results. 
+   - Install the appropriate solution to add a workbook for your firewall. For example, install the Palo Alto firewall solution for Microsoft Sentinel to add the Palo Alto workbooks. The workbooks analyze your firewall traffic, providing you with correlations between your firewall data and threat events, and highlight suspicious events across entities. Workbooks provide you with information about trends in your traffic and let you drill down into and filter results. 
 
       ![Palo Alto dashboard](./media/qs-get-visibility/palo-alto-week-query.png)
 

articles/sentinel/health-audit.md

@@ -1,42 +1,44 @@
 ---
 title: Auditing and health monitoring in Microsoft Sentinel 
 description: Learn about the Microsoft Sentinel health and audit feature, which monitors service health drifts and user actions.
-author: limwainstein
-ms.author: lwainstein
+author: batamig
+ms.author: bagol
 ms.topic: conceptual
-ms.date: 01/17/2023
+ms.date: 05/20/2024
 ---
 
 # Auditing and health monitoring in Microsoft Sentinel 
 
-Microsoft Sentinel is a critical service for advancing and protecting the security of your organization’s technological and information assets, so you’ll want to rest assured that it’s always running smoothly and free of interference. You’ll want to be able to make sure that the service's many moving parts are always functioning as intended and that the service isn't being manipulated by unauthorized actions, whether by internal users or otherwise. You also might like to configure notifications of health drifts or unauthorized actions to be sent to relevant stakeholders who can respond or approve a response. For example, you can set conditions to trigger the sending of emails or Microsoft Teams messages to operations teams, managers, or officers, launch new tickets in your ticketing system, and so on.
+Microsoft Sentinel is a critical service for advancing and protecting the security of your organization’s technological and information assets, so you want to be sure that it's always running smoothly and free of interference. 
+
+You want to verify that the service's many moving parts are always functioning as intended, and it isn't being manipulated by unauthorized actions, whether by internal users or otherwise. You may also like to configure notifications of health drifts or unauthorized actions to be sent to relevant stakeholders who can respond or approve a response. For example, you can set conditions to trigger the sending of emails or Microsoft Teams messages to operations teams, managers, or officers, launch new tickets in your ticketing system, and so on.
 
 This article describes how Microsoft Sentinel’s health monitoring and auditing features let you monitor the activity of some of the service’s key resources and inspect logs of user actions within the service. 
 
-## Description
 
-This section describes the function and use cases of the health monitoring and auditing components.
+## Health and audit data storage
+
+Health and audit data are collected in two tables in your Log Analytics workspace: *SentinelHealth* and *SentinelAudit*
 
-### Data storage
+**Audit data** is collected in the *SentinelAudit* table.
 
-Health and audit data are collected in two tables in your Log Analytics workspace:
+**Health data** is collected in the *SentinelHealth* table, which captures events that record each time an automation rule is run and the end results of those runs. The *SentinelHealth* table includes:
 
-- Health data is collected in the *SentinelHealth* table.
-- Audit data is collected in the *SentinelAudit* table.
+- Whether actions launched in the rule succeed or fail, and the playbooks called by the rule.
+- Events that record the on-demand (manual or API-based) triggering of playbooks, including the identities that triggered them, and the end results of those runs
 
-The prevalent way you'll use this data is by querying these tables. 
+The *SentinelHealth* table doesn't include a record of the execution of a playbook's contents, only whether the playbook was launched successfully. A log of the actions taken within a playbook, which are Logic Apps workflows, are listed in the *AzureDiagnostics* table. The *AzureDiagnostics* provides you with a complete picture of your automation health when used in tandem with the *SentinelHealth* data.
 
-For best results, you should build your queries on the **pre-built functions** on these tables, ***_SentinelHealth()*** and ***_SentinelAudit()***, instead of querying the tables directly. These functions ensure the maintenance of your queries' backward compatibility in the event of changes being made to the schema of the tables themselves.
+The most common way you'll use this data is by querying these tables. For best results, build your queries on the **pre-built functions** on these tables, ***_SentinelHealth()*** and ***_SentinelAudit()***, instead of querying the tables directly. These functions ensure the maintenance of your queries' backward compatibility in the event of changes being made to the schema of the tables themselves.
 
 > [!IMPORTANT]
 >
-> - The *SentinelHealth* and *SentinelAudit* data tables are currently in **PREVIEW**. See the [Supplemental Terms of Use for Microsoft Azure Previews](https://azure.microsoft.com/support/legal/preview-supplemental-terms/) for additional legal terms that apply to Azure features that are in beta, preview, or otherwise not yet released into general availability.
-> 
-> - When monitoring the health of **playbooks**, you'll also need to capture Azure Logic Apps diagnostic events from your playbooks, in addition to the *SentinelHealth* data, in order to get the full picture of your playbook activity.  Azure Logic Apps diagnostic data is collected in the *AzureDiagnostics* table in your workspace.
+> The *SentinelHealth* and *SentinelAudit* data tables are currently in **PREVIEW**. See the [Supplemental Terms of Use for Microsoft Azure Previews](https://azure.microsoft.com/support/legal/preview-supplemental-terms/) for additional legal terms that apply to Azure features that are in beta, preview, or otherwise not yet released into general availability.
+>
 
-### Use cases
+### Questions to verify service health and audit data
 
-#### Health
+Use the following questions to guide your monitoring of Microsoft Sentinel's health and audit data:
 
 **Is the data connector running correctly?**
 
@@ -50,14 +52,12 @@ For best results, you should build your queries on the **pre-built functions** o
 
 [Did your analytics rule run when it was supposed to, and did it generate results](monitor-analytics-rule-integrity.md)? If you're expecting to see particular incidents in your queue but you don't, you want to know whether the rule ran but didn't find anything (or enough things), or didn't run at all.
 
-#### Audit
-
 **Were unauthorized changes made to an analytics rule?**
 
 [Was something changed in the rule](monitor-analytics-rule-integrity.md)? You didn't get the results you expected from your analytics rule, and it didn't have any health issues. You want to see if any unplanned changes were made to the rule, and if so, what changes were made, by whom, from where, and when.
 
 
-## How Microsoft Sentinel presents health and audit data
+## Health and audit monitoring flow
 
 To start collecting health and audit data, you need to [enable health and audit monitoring](enable-monitoring.md) in the Microsoft Sentinel settings. Then you can dive into the health and audit data that Microsoft Sentinel collects:
 

articles/sentinel/monitor-automation-health.md

@@ -1,10 +1,10 @@
 ---
 title: Monitor the health of your Microsoft Sentinel automation rules and playbooks
 description: Use the SentinelHealth and AzureDiagnostics data tables to keep track of your automation rules' and playbooks' execution and performance.
-author: yelevin
-ms.author: yelevin
+author: batamig
+ms.author: bagol
 ms.topic: how-to
-ms.date: 11/09/2022
+ms.date: 05/20/2024
 ms.service: microsoft-sentinel
 ---
 
@@ -14,33 +14,11 @@ To ensure proper functioning and performance of your security orchestration, aut
 
 Set up notifications of health events for relevant stakeholders, who can then take action. For example, define and send email or Microsoft Teams messages, create new tickets in your ticketing system, and so on.
 
-This article describes how to use Microsoft Sentinel's [health monitoring features](health-audit.md) to keep track of your automation rules and playbooks' health from within Microsoft Sentinel.
-
-## Summary
-
-
-
-
-- **Microsoft Sentinel automation health logs:**
-
-    - This log captures events that record the running of automation rules, and the end result of these runnings - if they succeeded or failed, and if they failed, why. The log records the collective success or failure of the launch of the actions in the rule, and it also lists the playbooks called by the rule.
-    - The log also captures events that record the on-demand (manual or API-based) triggering of playbooks, including the **identities that triggered them**, whether they succeeded or failed, and if they failed, why.
-    - This log *does not include* a record of the execution of the contents of a playbook, only of the success or failure of the launching of the playbook. For a log of the actions taken within a playbook, see the next list below.
-    - These logs are collected in the *SentinelHealth* table in Log Analytics.
-    
-    > [!IMPORTANT]
-    >
-    > The *SentinelHealth* data table is currently in **PREVIEW**. See the [Supplemental Terms of Use for Microsoft Azure Previews](https://azure.microsoft.com/support/legal/preview-supplemental-terms/) for additional legal terms that apply to Azure features that are in beta, preview, or otherwise not yet released into general availability.
-
-- **Azure Logic Apps diagnostics logs:**
-
-    - These logs capture the results of the running of playbooks (also known as Logic Apps workflows) and the actions in them.
-    - These logs provide you with a complete picture of your automation health when used in tandem with the automation health logs.
-    - These logs are collected in the *AzureDiagnostics* table in Log Analytics.
+This article describes how to use Microsoft Sentinel's health monitoring features to keep track of your automation rules and playbooks's health from within Microsoft Sentinel. For more information, see [Auditing and health monitoring in Microsoft Sentinel](health-audit.md).
 
 ## Use the SentinelHealth data table (Public preview)
 
-To get automation health data from the *SentinelHealth* data table, you must first turn on the Microsoft Sentinel health feature for your workspace. For more information, see [Turn on health monitoring for Microsoft Sentinel](enable-monitoring.md).
+To get automation health data from the *SentinelHealth* data table, first turn on the Microsoft Sentinel health feature for your workspace. For more information, see [Turn on health monitoring for Microsoft Sentinel](enable-monitoring.md).
 
 Once the health feature is turned on, the *SentinelHealth* data table is created at the first success or failure event generated for your automation rules and playbooks.
 
@@ -66,21 +44,27 @@ For more information, see [SentinelHealth table columns schema](health-table-ref
 
 ### Statuses, errors and suggested steps
 
-For **Automation rule run**, you may see the following statuses:
-- Success: rule executed successfully, triggering all actions.
-- Partial success: rule executed and triggered at least one action, but some actions failed.
-- Failure: automation rule did not run any action due to one of the following reasons:
+For the **Automation rule run** status, you may see the following statuses:
+
+- **Success**: rule executed successfully, triggering all actions.
+- **Partial success**: rule executed and triggered at least one action, but some actions failed.
+- *Failure*: automation rule did not run any action due to one of the following reasons:
+
     - Conditions evaluation failed.
     - Conditions met, but the first action failed.
 
-For **Playbook was triggered**, you may see the following statuses:
-- Success: playbook was triggered successfully.
-- Failure: playbook could not be triggered. 
+For the **Playbook was triggered** status, you may see the following statuses:
+
+- **Success**: playbook was triggered successfully.
+- **Failure**: playbook could not be triggered.
+
     > [!NOTE]
     > 
-    > "Success" means only that the automation rule successfully triggered a playbook. It doesn't tell you when the playbook started or ended, the results of the actions in the playbook, or the final result of the playbook. To find this information, query the Logic Apps diagnostics logs (see the instructions later in this article).
+    > **Success** means only that the automation rule successfully triggered a playbook. It doesn't tell you when the playbook started or ended, the results of the actions in the playbook, or the final result of the playbook.
+    >
+    > To find this information, query the Logic Apps diagnostics logs. For more information, see [Get the complete automation picture](#get-the-complete-automation-picture).
 
-#### Error descriptions and suggested actions
+### Error descriptions and suggested actions
 
 | Error description                 | Suggested actions                         |
 | --------------------------------- | ----------------------------------------- |
@@ -106,14 +90,14 @@ For **Playbook was triggered**, you may see the following statuses:
 
 ## Get the complete automation picture
 
-Microsoft Sentinel's health monitoring table allows you to track the triggering of playbooks, but to monitor what happens inside your playbooks and their results when they're run, you must also [turn on diagnostics in Azure Logic Apps](../logic-apps/monitor-workflows-collect-diagnostic-data.md) to ingest the following events to the *AzureDiagnostics* table:
+Microsoft Sentinel's health monitoring table allows you to track when playbooks are triggered, but to monitor what happens inside your playbooks and their results when they're run, you must also [turn on diagnostics in Azure Logic Apps](../logic-apps/monitor-workflows-collect-diagnostic-data.md) to ingest the following events to the *AzureDiagnostics* table:
 
 - {Action name} started
 - {Action name} ended
 - Workflow (playbook) started
 - Workflow (playbook) ended
 
-These added events will give you additional insights into the actions being taken in your playbooks.
+These added events provide additional insights into the actions being taken in your playbooks.
 
 ### Turn on Azure Logic Apps diagnostics
 
@@ -149,11 +133,14 @@ SentinelHealth
 ## Use the health monitoring workbook
 
 The **Automation health** workbook helps you visualize your health data, as well as the correlation between the two types of logs that we just mentioned. The workbook includes the following displays:
+
 - Automation rule health and details
 - Playbook trigger health and details
 - Playbook runs health and details (requires Azure Diagnostic enabled on the Playbook level)
 - Automation details per incident
 
+For example:
+
 :::image type="content" source="media/monitor-automation-health/automation-health-monitoring-workbook.png" alt-text="Screenshot shows the opening panel of the automation health workbook.":::
 
 Select the **Playbooks run by Automation Rules** tab to see playbook activity.