↳ GitHub sourceAnalytics ruleInformational
Speculus - Threat intelligence feed outage
Description
'Detects when no Speculus threat intelligence indicators have been received for more than 24 hours.
The Speculus indexer refreshes continuously, so a silent day usually means an expired API key,
a connector misconfiguration, or a feed-side outage rather than an empty feed.'
- Rule type
- Scheduled
- Version
- 1.0.0
- Declared status
- Available
- Query frequency
- 6h
- Query period
- 2d
- Trigger
- gt 0
Declared MITRE coverage
Declared sources
Metadata from the source file. No dependencies inferred from KQL.
Connectors
Data types
KQL query
Original query, unchanged.
Speculus_Indicators_CL
| summarize LastReceived = max(TimeGenerated)
| where isnull(LastReceived) or LastReceived < ago(1d)
| extend
HoursSinceLastIndicator = iff(isnull(LastReceived), long(null), datetime_diff('hour', now(), LastReceived)),
Status = iff(isnull(LastReceived), 'No data ever received in query period', 'Feed silent for more than 24 hours')
Related content
Links established from declared identifiers and solution manifests.
Source provenance
GitHubDisplayed values come from files in Azure/Azure-Sentinel. They describe the published template, not your workspace configuration.
- Commit
9800e51↗- Source identifier
c4f2a8d1-6e39-4c07-b5a2-1d8e3f7c9a25
GSTEP / CATALOG TRACKING
Added to catalog : 16 Sept 2026 · 05:49 UTC
Last change observed : 16 Sept 2026 · 05:49 UTC