Last Heartbeat Arc Machines

Description

This query lists the latest heartbeat for each Azure Arc onboarded machine.

Query · kql

let ArcMachines = arg("").Resources
| where type == "microsoft.hybridcompute/machines"
| distinct id;
Heartbeat
| summarize arg_max(TimeGenerated, TimeGenerated, Computer, Resource, ResourceId) by Computer
| where ResourceId in (ArcMachines)
Raw source Last Heartbeat Arc Machines · KQL
Esc
Published by Bert-JanP/Hunting-Queries-Detection-Rules ↗, licensed under BSD 3-Clause ↗. Reproduced here unmodified. 
# Last Heartbeat Arc Machines

## Query Information

#### Description
This query lists the latest heartbeat for each Azure Arc onboarded machine.

## Sentinel
```KQL
let ArcMachines = arg("").Resources
| where type == "microsoft.hybridcompute/machines"
| distinct id;
Heartbeat
| summarize arg_max(TimeGenerated, TimeGenerated, Computer, Resource, ResourceId) by Computer
| where ResourceId in (ArcMachines)
```

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.