SentinelHealth table provides no results

Justyna Kotowska 50 Reputation points
2026-06-17T07:19:35.66+00:00

In our log analytic workspace in Microsoft Sentinel we have no results for SentinelHealth table - Germany region.

The rules are of course executing so there should be something. Do you know what could be the reason?

Microsoft Security | Microsoft Sentinel
Answer accepted by question author
VEMULA SRISAI 13,985 Reputation points Microsoft External Staff Moderator
2026-06-17T07:51:05.9+00:00

Hello Justyna Kotowska,

If you’re seeing no results for the SentinelHealth table in Microsoft Sentinel (Germany region), even though you expect Sentinel rules/health monitoring to be active, the most likely explanations are usually around health feature enablement, workspace/connector health coverage, or data not arriving into the Log Analytics workspace.

1) First check: is Sentinel health monitoring enabled for the workspace?

SentinelHealth is the table used for health logs for operations performed by Microsoft Sentinel resources (for example, data connectors and analytics rules). According to the SentinelHealth troubleshooting guidance, you must turn on the Microsoft Sentinel health feature for your workspace before you should expect health records to appear.

What to do

  • In Microsoft Sentinel, enable the health monitoring feature (if it’s not already enabled) for that workspace.
  • Then allow some time for health events to be generated.

2) Validate that SentinelHealth data is actually being ingested into Log Analytics

Microsoft Sentinel can only query/visualize data that’s present in the Log Analytics workspace. If logs aren’t reaching the workspace, you’ll see empty results.

What to do

  • Open Microsoft Sentinel > General > Logs and run a basic query like:
    • SentinelHealth | take 10
    • If you still get nothing, that indicates either the health feature isn’t enabled, or ingestion is failing for health events.

3) Know what SentinelHealth represents (it’s not “query results” from analytics rules)

One common misunderstanding: SentinelHealth tracks Sentinel resource health/operations, not necessarily the “expected business data” you might be thinking of. So “rules are executing” does not always guarantee you’ll see SentinelHealth rows unless the health monitoring is enabled and producing events, and depending on what operations are being monitored.

(There’s also guidance noting that health monitoring can be connector/rule operation focused, and for verifying actual ingestion into a given log table, you should query that target table directly.)

4) If this is specific to analytics rule integrity

SentinelHealth is used alongside SentinelAudit for analytics rule integrity monitoring. If analytics rule integrity monitoring is relevant for your scenario, check whether that monitoring path is enabled/configured and whether there are recent rule runs that would generate health events.

Follow-up questions (to pinpoint the root cause)

  1. In the Sentinel workspace, has the Microsoft Sentinel health monitoring feature been enabled for that workspace?
  2. When you run in Microsoft Sentinel > General > Logs: SentinelHealth | take 10 — do you get zero rows even without filtering by time?
  3. Roughly when were analytics/data connector rules last modified or executed (and are you expecting health events tied to those operations)?
  4. Is your primary goal to confirm:
    • (a) that Sentinel resources are healthy / running, or
      • (b) that a specific data table is ingesting logs?
      1. Are there any recent errors in the health/audit area (for example in SentinelAudit), or is everything empty?

If you share what you’ve already tried (especially whether health monitoring is enabled), I can narrow it down quickly.

Was this answer helpful?

1 person found this answer helpful.
0 comments

1 additional answer

Sort by: Oldest
Most helpful Newest Oldest

  1. AI answer

    2026-06-17T07:19:50.58+00:00

    SentinelHealth data appears only after the Microsoft Sentinel health feature is enabled and the first relevant event is generated. If the SentinelHealth table returns no results, the most likely reasons are:

    1. Health/audit monitoring is not enabled for the workspace.
      • Health and audit data are collected only after turning on the Microsoft Sentinel health feature for the workspace. Until then, SentinelHealth and SentinelAudit will not populate.
      • Enable auditing and health monitoring as described in Turn on auditing and health monitoring for Microsoft Sentinel. After enabling, wait for at least one analytics rule or automation run to occur.
    2. No qualifying SentinelHealth events have been generated yet.
      • SentinelHealth is created at the first success or failure event generated for automation rules and playbooks, and also logs analytics rule health events (scheduled and NRT rule runs).
      • If no automation rules, playbooks, or analytics rule runs have produced health events since enabling the feature, the table can remain empty. After rules run, query again.
    3. Querying the wrong object or without the helper function.
      • For best results, use the prebuilt function rather than the raw table: 
             _SentinelHealth()
     | where TimeGenerated > ago(1d)
      • To focus on analytics rules: 
             _SentinelHealth()
     | where SentinelResourceType == "Analytics Rule"

    If health monitoring is confirmed enabled and rules are actively running but SentinelHealth still has no data, re-validate that it was enabled on the same Log Analytics workspace where Sentinel is attached, then wait for a new rule execution window and re-run the query using _SentinelHealth().

    References:

    AI-generated content may be incorrect. Read our transparency notes for more information.

    Was this answer helpful?

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.