Monitor the health of your automation rules and playbooks

To ensure proper functioning and performance of your security orchestration, automation, and response operations in your Microsoft Sentinel service, keep track of the health of your automation rules and playbooks by monitoring their execution logs.

Set up notifications of health events for relevant stakeholders, who can then take action. For example, define and send email or Microsoft Teams messages, create new tickets in your ticketing system, and so on.

This article describes how to use Microsoft Sentinel's health monitoring features to keep track of your automation rules and playbooks's health from within Microsoft Sentinel. For more information, see Auditing and health monitoring in Microsoft Sentinel.

Use the SentinelHealth data table (Public preview)

To get automation health data from the SentinelHealth data table, first turn on the Microsoft Sentinel health feature for your workspace. For more information, see Turn on health monitoring for Microsoft Sentinel.

Once the health feature is turned on, the SentinelHealth data table is created at the first success or failure event generated for your automation rules and playbooks.

Understanding SentinelHealth table events

The following types of automation health events are logged in the SentinelHealth table:

• Automation rule run. Logged whenever an automation rule's conditions are met, causing it to run. Besides the fields in the basic SentinelHealth table, these events will include extended properties unique to the running of automation rules, including a list of the playbooks called by the rule. The following sample query will display these events:

  SentinelHealth
  | where OperationName == "Automation rule run"
  

• Playbook was triggered. Logged whenever a playbook is triggered on an incident manually from the portal or through the API. Besides the fields in the basic SentinelHealth table, these events will include extended properties unique to the manual triggering of playbooks. The following sample query will display these events:

  SentinelHealth
  | where OperationName == "Playbook was triggered"
  

For more information, see SentinelHealth table columns schema.

Statuses, errors and suggested steps

For the Automation rule run status, you may see the following statuses:

• Success: rule executed successfully, triggering all actions.

• Partial success: rule executed and triggered at least one action, but some actions failed.

• Failure: automation rule did not run any action due to one of the following reasons:

  • Conditions evaluation failed.
  • Conditions met, but the first action failed.

For the Playbook was triggered status, you may see the following statuses:

• Success: playbook was triggered successfully.

• Failure: playbook could not be triggered.

  Note

  Success means only that the automation rule successfully triggered a playbook. It doesn't tell you when the playbook started or ended, the results of the actions in the playbook, or the final result of the playbook.

  To find this information, query the Logic Apps diagnostics logs. For more information, see Get the complete automation picture.

Error descriptions and suggested actions

Get the complete automation picture

Microsoft Sentinel's health monitoring table allows you to track when playbooks are triggered, but to monitor what happens inside your playbooks and their results when they're run, you must also turn on diagnostics in Azure Logic Apps to ingest the following events to the AzureDiagnostics table:

• {Action name} started
• {Action name} ended
• Workflow (playbook) started
• Workflow (playbook) ended

These added events provide additional insights into the actions being taken in your playbooks.

Turn on Azure Logic Apps diagnostics

For each playbook you are interested in monitoring, enable Log Analytics for your logic app. Make sure to select Send to Log Analytics workspace as your log destination, and choose your Microsoft Sentinel workspace.

Correlate Microsoft Sentinel and Azure Logic Apps logs

Now that you have logs for your automation rules and playbooks and logs for your individual Logic Apps workflows in your workspace, you can correlate them to get the complete picture. Consider the following sample query:

SentinelHealth 
| where SentinelResourceType == "Automation rule"
| mv-expand TriggeredPlaybooks = ExtendedProperties.TriggeredPlaybooks
| extend runId = tostring(TriggeredPlaybooks.RunId)
| join (AzureDiagnostics 
    | where OperationName == "Microsoft.Logic/workflows/workflowRunCompleted"
    | project
        resource_runId_s,
        playbookName = resource_workflowName_s,
        playbookRunStatus = status_s)
    on $left.runId == $right.resource_runId_s
| project
    RecordId,
    TimeGenerated,
    AutomationRuleName= SentinelResourceName,
    AutomationRuleStatus = Status,
    Description,
    workflowRunId = runId,
    playbookName,
    playbookRunStatus

Use the health monitoring workbook

The Automation health workbook helps you visualize your health data, as well as the correlation between the two types of logs that we just mentioned. The workbook includes the following displays:

• Automation rule health and details
• Playbook trigger health and details
• Playbook runs health and details (requires Azure Diagnostic enabled on the Playbook level)
• Automation details per incident

For example:

Select the Playbooks run by Automation Rules tab to see playbook activity.

Select a playbook to see the list of its runs in the drill-down chart below.

Select a particular run to see the results of the actions in the playbook.

Next steps

• Learn about auditing and health monitoring in Microsoft Sentinel.
• Turn on auditing and health monitoring in Microsoft Sentinel.
• Monitor the health of your data connectors.
• Monitor the health and integrity of your analytics rules.
• See more information about the SentinelHealth and SentinelAudit table schemas.