{
    "api_version": "1",
    "kind": "dse_post",
    "self": "https://update.dsesecurity.com/api/v1/posts/dse-20260909-006-check-missing-summary-rule-intervals-before-accepting-a-log-analytics-trend/",
    "item": {
        "id": "https://update.dsesecurity.com/updates/dse-20260909-006-check-missing-summary-rule-intervals-before-accepting-a-log-analytics-trend/",
        "slug": "dse-20260909-006-check-missing-summary-rule-intervals-before-accepting-a-log-analytics-trend",
        "url": "https://update.dsesecurity.com/updates/dse-20260909-006-check-missing-summary-rule-intervals-before-accepting-a-log-analytics-trend/",
        "alternate_urls": {
            "markdown": "https://update.dsesecurity.com/updates/dse-20260909-006-check-missing-summary-rule-intervals-before-accepting-a-log-analytics-trend.md",
            "json": "https://update.dsesecurity.com/api/v1/posts/dse-20260909-006-check-missing-summary-rule-intervals-before-accepting-a-log-analytics-trend/"
        },
        "title": "Check missing summary-rule intervals before accepting a Log Analytics trend",
        "summary": "How should an operator distinguish a quiet interval from an unsuccessful summary-rule bin?",
        "format": {
            "slug": "guide",
            "name": "Guide"
        },
        "priority": {
            "slug": "info",
            "name": "Information"
        },
        "featured": false,
        "image": {
            "theme": "network-infrastructure",
            "label": "Networks & infrastructure",
            "alt": "Resilient network core with engineered blue and gold data paths.",
            "card_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-card.webp?v=1.8.20",
            "hero_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-hero.webp?v=1.8.20",
            "social_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20",
            "width": 2400,
            "height": 1350
        },
        "topics": [
            {
                "slug": "business-continuity",
                "name": "Business Continuity",
                "url": "https://update.dsesecurity.com/topic/business-continuity/"
            },
            {
                "slug": "networks-infrastructure",
                "name": "Networks & Infrastructure",
                "url": "https://update.dsesecurity.com/topic/networks-infrastructure/"
            }
        ],
        "author": {
            "name": "DSE Security Editorial Team",
            "url": "https://update.dsesecurity.com/#editorial-team",
            "type": "Organization"
        },
        "publisher": {
            "name": "Detection Systems & Engineering",
            "url": "https://dsesecurity.com/"
        },
        "published_at": "2026-09-10T00:31:50+00:00",
        "modified_at": "2026-09-10T00:31:59+00:00",
        "reviewed_on": "2026-09-09",
        "reading_minutes": 2,
        "word_count": 255,
        "potentially_affected": "Log Analytics workspaces using summary rules in the public cloud.",
        "dse_recommendation": "Reconcile successful bin execution with the reporting interval before accepting an aggregate trend.",
        "primary_source": {
            "name": "Aggregate data in a Log Analytics workspace with summary rules - Azure Monitor | Microsoft Learn",
            "url": "https://learn.microsoft.com/en-us/azure/azure-monitor/logs/summary-rules",
            "published_on": null,
            "authority": "Microsoft Learn"
        },
        "publishing_principles": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/",
        "usage_info": "https://update.dsesecurity.com/usage/",
        "copyright_notice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.",
        "content_html": "<h2>Source facts</h2>\n<p>Summary rules periodically aggregate workspace logs into a custom table. Enabling the workspace&#8217;s Summary Logs diagnostic category sends execution outcomes to LASummaryLogs. A failed bin receives ten retry attempts within eight hours; after those attempts are exhausted, that bin is skipped. Microsoft also documents a hold after eight consecutive bin retries. <a href=\"https://learn.microsoft.com/en-us/azure/azure-monitor/logs/summary-rules\" target=\"_blank\" rel=\"noopener noreferrer\">Microsoft Learn</a>.</p>\n<p>The source provides a completeness query using successful runs and BinStartTime. A manually retried run is identified by its failed bin&#8217;s start time, not an arbitrary reporting timestamp. <a href=\"https://learn.microsoft.com/en-us/azure/azure-monitor/logs/summary-rules\" target=\"_blank\" rel=\"noopener noreferrer\">Microsoft Learn</a>.</p>\n<h2>Applicability</h2>\n<p>Apply this review to Log Analytics workspaces using summary rules in the public cloud. Summary rules are unavailable outside that cloud scope. <a href=\"https://learn.microsoft.com/en-us/azure/azure-monitor/logs/summary-rules\" target=\"_blank\" rel=\"noopener noreferrer\">Microsoft Learn</a>. Keep the rule&#8217;s configured bin size and the report&#8217;s time range in the review record. Treat completeness as a question to establish, not something implied by an attractive chart.</p>\n<h2>DSE recommendation</h2>\n<p>DSE recommends checking execution coverage before interpreting a drop in summarized activity. Assign missing intervals to a separate exception list, with their rule name and bin start. Ask the rule owner to investigate failed execution before requesting a rerun. Do not quietly replace unknown intervals with zero in a management report; label the uncertainty until evidence resolves it.</p>\n<h2>Verification</h2>\n<p>For an approved sample period, compare the expected interval sequence with successful execution records and the destination results. Preserve the missing-bin list, any retry request, and its observed outcome. Have a second reviewer confirm that the final trend distinguishes measured values from intervals that remain unverified.</p>\n<h2>Official references</h2>\n<p><a href=\"https://learn.microsoft.com/en-us/azure/azure-monitor/logs/summary-rules\" target=\"_blank\" rel=\"noopener noreferrer\">Microsoft Learn: Aggregate data with summary rules</a>.</p>",
        "content_text": "Source facts\nSummary rules periodically aggregate workspace logs into a custom table. Enabling the workspace’s Summary Logs diagnostic category sends execution outcomes to LASummaryLogs. A failed bin receives ten retry attempts within eight hours; after those attempts are exhausted, that bin is skipped. Microsoft also documents a hold after eight consecutive bin retries. Microsoft Learn.\nThe source provides a completeness query using successful runs and BinStartTime. A manually retried run is identified by its failed bin’s start time, not an arbitrary reporting timestamp. Microsoft Learn.\nApplicability\nApply this review to Log Analytics workspaces using summary rules in the public cloud. Summary rules are unavailable outside that cloud scope. Microsoft Learn. Keep the rule’s configured bin size and the report’s time range in the review record. Treat completeness as a question to establish, not something implied by an attractive chart.\nDSE recommendation\nDSE recommends checking execution coverage before interpreting a drop in summarized activity. Assign missing intervals to a separate exception list, with their rule name and bin start. Ask the rule owner to investigate failed execution before requesting a rerun. Do not quietly replace unknown intervals with zero in a management report; label the uncertainty until evidence resolves it.\nVerification\nFor an approved sample period, compare the expected interval sequence with successful execution records and the destination results. Preserve the missing-bin list, any retry request, and its observed outcome. Have a second reviewer confirm that the final trend distinguishes measured values from intervals that remain unverified.\nOfficial references\nMicrosoft Learn: Aggregate data with summary rules.",
        "content_markdown": "## Source facts\n\nSummary rules periodically aggregate workspace logs into a custom table. Enabling the workspace’s Summary Logs diagnostic category sends execution outcomes to LASummaryLogs. A failed bin receives ten retry attempts within eight hours; after those attempts are exhausted, that bin is skipped. Microsoft also documents a hold after eight consecutive bin retries. [Microsoft Learn](https://learn.microsoft.com/en-us/azure/azure-monitor/logs/summary-rules).\n\nThe source provides a completeness query using successful runs and BinStartTime. A manually retried run is identified by its failed bin’s start time, not an arbitrary reporting timestamp. [Microsoft Learn](https://learn.microsoft.com/en-us/azure/azure-monitor/logs/summary-rules).\n\n## Applicability\n\nApply this review to Log Analytics workspaces using summary rules in the public cloud. Summary rules are unavailable outside that cloud scope. [Microsoft Learn](https://learn.microsoft.com/en-us/azure/azure-monitor/logs/summary-rules). Keep the rule’s configured bin size and the report’s time range in the review record. Treat completeness as a question to establish, not something implied by an attractive chart.\n\n## DSE recommendation\n\nDSE recommends checking execution coverage before interpreting a drop in summarized activity. Assign missing intervals to a separate exception list, with their rule name and bin start. Ask the rule owner to investigate failed execution before requesting a rerun. Do not quietly replace unknown intervals with zero in a management report; label the uncertainty until evidence resolves it.\n\n## Verification\n\nFor an approved sample period, compare the expected interval sequence with successful execution records and the destination results. Preserve the missing-bin list, any retry request, and its observed outcome. Have a second reviewer confirm that the final trend distinguishes measured values from intervals that remain unverified.\n\n## Official references\n\n[Microsoft Learn: Aggregate data with summary rules](https://learn.microsoft.com/en-us/azure/azure-monitor/logs/summary-rules)."
    },
    "json_ld": {
        "@context": "https://schema.org",
        "@graph": [
            {
                "@type": "Organization",
                "@id": "https://dsesecurity.com/#organization",
                "name": "Detection Systems & Engineering",
                "alternateName": "DSE Security",
                "url": "https://dsesecurity.com/",
                "logo": {
                    "@type": "ImageObject",
                    "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20"
                }
            },
            {
                "@type": "Organization",
                "@id": "https://update.dsesecurity.com/#editorial-team",
                "name": "DSE Security Editorial Team",
                "url": "https://update.dsesecurity.com/",
                "parentOrganization": {
                    "@id": "https://dsesecurity.com/#organization"
                }
            },
            {
                "@type": "WebSite",
                "@id": "https://update.dsesecurity.com/#website",
                "name": "DSE Updates",
                "alternateName": "DSE Security Knowledge Hub",
                "url": "https://update.dsesecurity.com/",
                "inLanguage": "en-US",
                "publisher": {
                    "@id": "https://dsesecurity.com/#organization"
                },
                "potentialAction": {
                    "@type": "SearchAction",
                    "target": {
                        "@type": "EntryPoint",
                        "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}"
                    },
                    "query-input": "required name=search_term_string"
                }
            },
            {
                "@type": "WebPage",
                "@id": "https://update.dsesecurity.com/updates/dse-20260909-006-check-missing-summary-rule-intervals-before-accepting-a-log-analytics-trend/",
                "url": "https://update.dsesecurity.com/updates/dse-20260909-006-check-missing-summary-rule-intervals-before-accepting-a-log-analytics-trend/",
                "isPartOf": {
                    "@id": "https://update.dsesecurity.com/#website"
                },
                "lastReviewed": "2026-09-09"
            },
            {
                "@type": "BreadcrumbList",
                "@id": "https://update.dsesecurity.com/updates/dse-20260909-006-check-missing-summary-rule-intervals-before-accepting-a-log-analytics-trend/#breadcrumbs",
                "itemListElement": [
                    {
                        "@type": "ListItem",
                        "position": 1,
                        "name": "DSE Updates",
                        "item": "https://update.dsesecurity.com/"
                    },
                    {
                        "@type": "ListItem",
                        "position": 2,
                        "name": "Check missing summary-rule intervals before accepting a Log Analytics trend",
                        "item": "https://update.dsesecurity.com/updates/dse-20260909-006-check-missing-summary-rule-intervals-before-accepting-a-log-analytics-trend/"
                    }
                ]
            },
            {
                "@type": [
                    "Article",
                    "TechArticle"
                ],
                "@id": "https://update.dsesecurity.com/updates/dse-20260909-006-check-missing-summary-rule-intervals-before-accepting-a-log-analytics-trend/#article",
                "identifier": "https://update.dsesecurity.com/updates/dse-20260909-006-check-missing-summary-rule-intervals-before-accepting-a-log-analytics-trend/",
                "url": "https://update.dsesecurity.com/updates/dse-20260909-006-check-missing-summary-rule-intervals-before-accepting-a-log-analytics-trend/",
                "headline": "Check missing summary-rule intervals before accepting a Log Analytics trend",
                "description": "How should an operator distinguish a quiet interval from an unsuccessful summary-rule bin?",
                "abstract": "How should an operator distinguish a quiet interval from an unsuccessful summary-rule bin?",
                "articleBody": "Source facts\nSummary rules periodically aggregate workspace logs into a custom table. Enabling the workspace’s Summary Logs diagnostic category sends execution outcomes to LASummaryLogs. A failed bin receives ten retry attempts within eight hours; after those attempts are exhausted, that bin is skipped. Microsoft also documents a hold after eight consecutive bin retries. Microsoft Learn.\nThe source provides a completeness query using successful runs and BinStartTime. A manually retried run is identified by its failed bin’s start time, not an arbitrary reporting timestamp. Microsoft Learn.\nApplicability\nApply this review to Log Analytics workspaces using summary rules in the public cloud. Summary rules are unavailable outside that cloud scope. Microsoft Learn. Keep the rule’s configured bin size and the report’s time range in the review record. Treat completeness as a question to establish, not something implied by an attractive chart.\nDSE recommendation\nDSE recommends checking execution coverage before interpreting a drop in summarized activity. Assign missing intervals to a separate exception list, with their rule name and bin start. Ask the rule owner to investigate failed execution before requesting a rerun. Do not quietly replace unknown intervals with zero in a management report; label the uncertainty until evidence resolves it.\nVerification\nFor an approved sample period, compare the expected interval sequence with successful execution records and the destination results. Preserve the missing-bin list, any retry request, and its observed outcome. Have a second reviewer confirm that the final trend distinguishes measured values from intervals that remain unverified.\nOfficial references\nMicrosoft Learn: Aggregate data with summary rules.",
                "datePublished": "2026-09-10T00:31:50+00:00",
                "dateModified": "2026-09-10T00:31:59+00:00",
                "mainEntityOfPage": {
                    "@id": "https://update.dsesecurity.com/updates/dse-20260909-006-check-missing-summary-rule-intervals-before-accepting-a-log-analytics-trend/"
                },
                "inLanguage": "en-US",
                "isAccessibleForFree": true,
                "author": {
                    "@type": "Organization",
                    "name": "DSE Security Editorial Team",
                    "url": "https://update.dsesecurity.com/#editorial-team"
                },
                "publisher": {
                    "@id": "https://dsesecurity.com/#organization"
                },
                "image": {
                    "@type": "ImageObject",
                    "@id": "https://update.dsesecurity.com/updates/dse-20260909-006-check-missing-summary-rule-intervals-before-accepting-a-log-analytics-trend/#primaryimage",
                    "url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20",
                    "contentUrl": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20",
                    "width": 1200,
                    "height": 630,
                    "caption": "Check missing summary-rule intervals before accepting a Log Analytics trend"
                },
                "articleSection": [
                    "Business Continuity",
                    "Networks & Infrastructure"
                ],
                "keywords": [
                    "Business Continuity",
                    "Networks & Infrastructure",
                    "Guide",
                    "Information priority"
                ],
                "genre": "Guide",
                "about": [
                    {
                        "@type": "Thing",
                        "name": "Business Continuity",
                        "url": "https://update.dsesecurity.com/topic/business-continuity/"
                    },
                    {
                        "@type": "Thing",
                        "name": "Networks & Infrastructure",
                        "url": "https://update.dsesecurity.com/topic/networks-infrastructure/"
                    }
                ],
                "wordCount": 255,
                "timeRequired": "PT2M",
                "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/",
                "usageInfo": "https://update.dsesecurity.com/usage/",
                "copyrightHolder": {
                    "@id": "https://dsesecurity.com/#organization"
                },
                "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.",
                "citation": {
                    "@type": "CreativeWork",
                    "name": "Aggregate data in a Log Analytics workspace with summary rules - Azure Monitor | Microsoft Learn",
                    "url": "https://learn.microsoft.com/en-us/azure/azure-monitor/logs/summary-rules"
                }
            }
        ]
    }
}