Check Point Exposure Management - Alert Ingestion Anomaly

Original query, unchanged.

let lookback = 24h;
let expected_interval = 1h;
let last_record = toscalar(
    argsentdc_CL
    | where TimeGenerated > ago(lookback)
    | summarize max(TimeGenerated)
);
let gap_minutes = datetime_diff('minute', now(), last_record);
// Alert if no records in the last expected_interval, but there WERE records in the lookback period
// (avoids alerting on brand-new deployments with no data yet)
argsentdc_CL
| where TimeGenerated > ago(lookback)
| summarize
    LastIngestionTime = max(TimeGenerated),
    TotalRecords = count(),
    DistinctAlerts = dcount(ref_id)
| where LastIngestionTime < ago(expected_interval)
| extend GapMinutes = datetime_diff('minute', now(), LastIngestionTime)
| project
    LastIngestionTime,
    GapMinutes,
    TotalRecords,
    DistinctAlerts,
    Message = strcat("No Check Point Exposure Management alerts ingested for ", GapMinutes, " minutes. Last record at ", LastIngestionTime)