↳ GitHub sourceAnalytics ruleMedium

CTE - Stale Device (No Heartbeat in 30 Days)

Description

A device is still marked active in the Devices table but has not sent a heartbeat in 30+ days. Emitted once per device by the daily tenant health-check job (api/src/functions/tenantHealthChecks.js); clears automatically if the device checks in again, so it can re-fire after a later gap.

Rule type: Scheduled
Version: 1.0.0
Query frequency: 24h
Query period: 2d
Trigger: gt 0

Declared MITRE coverage

DefenseEvasion T1562

Declared sources

Metadata from the source file. No dependencies inferred from KQL.

Connectors

cybereinforce_cte

Data types

CybereinforceCTE_CL

KQL query

Original query, unchanged.

CybereinforceCTE_CL
| where EventType == "device.stale_heartbeat"
| extend d = parse_json(Details)
| extend
    DeviceId = tostring(d.deviceId),
    HostName = iff(isnotempty(tostring(d.hostname)), tostring(d.hostname), strcat("cte-device-", substring(EntityId, 0, 8))),
    LastSeen = tostring(d.lastSeen)
| project TimeGenerated, TenantId, DeviceId, HostName, LastSeen, Severity, Category, Source

Declared entities

Host

Source provenance

GitHub

Displayed values come from files in Azure/Azure-Sentinel. They describe the published template, not your workspace configuration.

File: Solutions/Cybereinforce/Analytic Rules/StaleDeviceNoHeartbeatIn30Days.yaml ↗
Commit: 9800e51 ↗
Source identifier: a6d51bc1-bf51-47d1-9885-b81762cd6306

Additional source files 2

Solutions/Cybereinforce/Analytic Rules/StaleDeviceNoHeartbeatIn30Days.yamlsource ↗Solutions/Cybereinforce/Data/Solution_Cybereinforce.jsonsolution-membership ↗

GSTEP / CATALOG TRACKING

Added to catalog : 16 Sept 2026 · 05:49 UTC
Last change observed : 16 Sept 2026 · 05:49 UTC

GSTEP sync dates, separate from the source content’s publication dates.