Hey folks, hitting a real head-scratcher with Sentinel analytic rules today and could use a second pair of eyes. I've built a rule using a KQL query that runs perfectly in the "Logs" section—returns the exact suspicious events I'm looking for. But when I set it up as a scheduled analytics rule, it never triggers. No incidents, no alerts, nada. The query test passes in the rule wizard, so validation seems fine.
I'm wondering if it's a timing or state issue. My query looks for specific Azure AD anomalies and uses `make-series` to flag patterns. Here's a simplified version of what works in Logs:
```kql
AuditLogs
| where TimeGenerated > ago(1h)
| where OperationName == "Add member to role"
| extend TargetRole = tostring(TargetResources[0].DisplayName)
| where TargetRole contains "Global Administrator"
| summarize StartTimeUtc = min(TimeGenerated), EndTimeUtc = max(TimeGenerated) by bin(TimeGenerated, 5m), IPAddress, User
```
The rule is set to run every 5 minutes, querying the last hour. I've double-checked the alert threshold (set to greater than 0) and the schedule. The rule is enabled and linked to a clean incident configuration.
Has anyone run into this gap between the Logs explorer and the analytics engine? I'm thinking maybe:
1. The `TimeGenerated` field behaves differently in the scheduled rule context?
2. There's a hidden latency with the underlying table ingestion that the Logs UI compensates for but the rule doesn't?
3. My query, while valid, might be using a function or operator that the analytics rule scheduler restricts?
I love Sentinel's potential, but these silent failures are tough to debug. Any pointers on where to look next would be awesome. I've already verified workspace permissions and that the table has fresh data within the query time range.
~d