Microsoft Sentinel informational experimental kql

Speculus - Threat intelligence feed outage

'Detects when no Speculus threat intelligence indicators have been received for more than 24 hours. The Speculus indexer refreshes continuously, so a silent day usually means an expired API key, a connector misconfiguration, or a feed-side outage rather than an empty feed.'

View Source

Detection Logic

Speculus_Indicators_CL
| summarize LastReceived = max(TimeGenerated)
| where isnull(LastReceived) or LastReceived < ago(1d)
| extend
    HoursSinceLastIndicator = iff(isnull(LastReceived), long(null), datetime_diff('hour', now(), LastReceived)),
    Status = iff(isnull(LastReceived), 'No data ever received in query period', 'Feed silent for more than 24 hours')

Field Validations

Loading…

Comments (0)

Loading comments...