Share via

Queries for the Anomalies table

  • Article

For information on using these queries in the Azure portal, see Log Analytics tutorial. For the REST API, see Query.

Get Production Anomalies (last day)

Gets a list of all anomalies generated by a production Sentinel rule in the last day

Anomalies
| where TimeGenerated > ago(1d)
| where RuleStatus == "Production"

Get Flighting Anomalies (last day)

Gets a list of all anomalies generated by a flighting Sentinel rule in the last day

Anomalies
| where TimeGenerated > ago(1d)
| where RuleStatus == "Flighting"