{ "api_version": "1", "kind": "dse_post", "self": "https://update.dsesecurity.com/api/v1/posts/dse-20260909-348-give-each-query-based-health-signal-one-deliberate-numeric-result/", "item": { "id": "https://update.dsesecurity.com/updates/dse-20260909-348-give-each-query-based-health-signal-one-deliberate-numeric-result/", "slug": "dse-20260909-348-give-each-query-based-health-signal-one-deliberate-numeric-result", "url": "https://update.dsesecurity.com/updates/dse-20260909-348-give-each-query-based-health-signal-one-deliberate-numeric-result/", "alternate_urls": { "markdown": "https://update.dsesecurity.com/updates/dse-20260909-348-give-each-query-based-health-signal-one-deliberate-numeric-result.md", "json": "https://update.dsesecurity.com/api/v1/posts/dse-20260909-348-give-each-query-based-health-signal-one-deliberate-numeric-result/" }, "title": "Give each query-based health signal one deliberate numeric result", "summary": "What query result should a Log Analytics or Prometheus health-model signal return?", "format": { "slug": "guide", "name": "Guide" }, "priority": { "slug": "info", "name": "Information" }, "featured": false, "image": { "theme": "managed-it", "label": "Managed IT operations", "alt": "A controlled technology lifecycle progressing from assessment to approved production.", "card_url": "https://update.dsesecurity.com/assets/editorial/managed-it-card.webp?v=1.8.20", "hero_url": "https://update.dsesecurity.com/assets/editorial/managed-it-hero.webp?v=1.8.20", "social_url": "https://update.dsesecurity.com/assets/editorial/managed-it-social-v2.jpg?v=1.8.20", "width": 2400, "height": 1350 }, "topics": [ { "slug": "business-continuity", "name": "Business Continuity", "url": "https://update.dsesecurity.com/topic/business-continuity/" }, { "slug": "it", "name": "IT", "url": "https://update.dsesecurity.com/topic/it/" } ], "author": { "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team", "type": "Organization" }, "publisher": { "name": "Detection Systems & Engineering", "url": "https://dsesecurity.com/" }, "published_at": "2026-09-10T00:26:08+00:00", "modified_at": "2026-09-10T01:40:04+00:00", "reviewed_on": "2026-09-09", "reading_minutes": 2, "word_count": 260, "potentially_affected": "Query-based signals in the Azure Monitor health-model preview using Log Analytics or Azure Monitor workspaces.", "dse_recommendation": "Define the entity, time scope and numerical meaning of the signal before reducing its query to one value.", "primary_source": { "name": "Configure signals in an Azure Monitor health model (preview) - Azure Monitor | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/azure/azure-monitor/health-models/tutorial-signals", "published_on": null, "authority": "Microsoft Learn" }, "publishing_principles": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usage_info": "https://update.dsesecurity.com/usage/", "copyright_notice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "content_html": "

Source facts

\n

The Azure Monitor health-model preview requires a KQL log signal to return one numeric value; its PromQL signal has the same single-value requirement. The health-model identity needs permission to read the target telemetry, and the entity must map to a real data source. The configuration then assigns degraded and unhealthy thresholds to the signal. A saved signal definition can be reused for other entities within the same model. Microsoft Learn.

\n

Applicability

\n

Use this check when converting an investigative query into an approved preview health signal. First identify the exact entity and observation the number should describe. A useful multirow investigation result is not yet the required scalar signal.

\n

DSE recommendation

\n

Define the entity, time scope and numerical meaning of the signal before reducing its query to one value. Ask the service owner to explain what a threshold crossing means operationally. Keep the selected population visible in the query review so aggregation does not inadvertently combine unrelated entities. Where a definition will be reused, inspect each intended assignment rather than assuming the original query context fits every target.

\n

Verification

\n

Run the proposed query under the intended reading identity and inspect the actual result shape and value. Compare it with a separately understood sample of the underlying telemetry. Exercise representative normal and adverse observations in a controlled test, then inspect Graph and Timeline transitions against the chosen thresholds. Preserve the query, assignment and observed value together; successful saving alone does not establish that the number represents the intended entity.

\n

Official references

\n

Microsoft Learn: Configure health-model signals preview. Source reviewed September 9, 2026.

", "content_text": "Source facts\nThe Azure Monitor health-model preview requires a KQL log signal to return one numeric value; its PromQL signal has the same single-value requirement. The health-model identity needs permission to read the target telemetry, and the entity must map to a real data source. The configuration then assigns degraded and unhealthy thresholds to the signal. A saved signal definition can be reused for other entities within the same model. Microsoft Learn.\nApplicability\nUse this check when converting an investigative query into an approved preview health signal. First identify the exact entity and observation the number should describe. A useful multirow investigation result is not yet the required scalar signal.\nDSE recommendation\nDefine the entity, time scope and numerical meaning of the signal before reducing its query to one value. Ask the service owner to explain what a threshold crossing means operationally. Keep the selected population visible in the query review so aggregation does not inadvertently combine unrelated entities. Where a definition will be reused, inspect each intended assignment rather than assuming the original query context fits every target.\nVerification\nRun the proposed query under the intended reading identity and inspect the actual result shape and value. Compare it with a separately understood sample of the underlying telemetry. Exercise representative normal and adverse observations in a controlled test, then inspect Graph and Timeline transitions against the chosen thresholds. Preserve the query, assignment and observed value together; successful saving alone does not establish that the number represents the intended entity.\nOfficial references\nMicrosoft Learn: Configure health-model signals preview. Source reviewed September 9, 2026.", "content_markdown": "## Source facts\n\nThe Azure Monitor health-model preview requires a KQL log signal to return one numeric value; its PromQL signal has the same single-value requirement. The health-model identity needs permission to read the target telemetry, and the entity must map to a real data source. The configuration then assigns degraded and unhealthy thresholds to the signal. A saved signal definition can be reused for other entities within the same model. [Microsoft Learn](https://learn.microsoft.com/en-us/azure/azure-monitor/health-models/tutorial-signals).\n\n## Applicability\n\nUse this check when converting an investigative query into an approved preview health signal. First identify the exact entity and observation the number should describe. A useful multirow investigation result is not yet the required scalar signal.\n\n## DSE recommendation\n\nDefine the entity, time scope and numerical meaning of the signal before reducing its query to one value. Ask the service owner to explain what a threshold crossing means operationally. Keep the selected population visible in the query review so aggregation does not inadvertently combine unrelated entities. Where a definition will be reused, inspect each intended assignment rather than assuming the original query context fits every target.\n\n## Verification\n\nRun the proposed query under the intended reading identity and inspect the actual result shape and value. Compare it with a separately understood sample of the underlying telemetry. Exercise representative normal and adverse observations in a controlled test, then inspect Graph and Timeline transitions against the chosen thresholds. Preserve the query, assignment and observed value together; successful saving alone does not establish that the number represents the intended entity.\n\n## Official references\n\n[Microsoft Learn: Configure health-model signals preview](https://learn.microsoft.com/en-us/azure/azure-monitor/health-models/tutorial-signals). Source reviewed September 9, 2026." }, "json_ld": { "@context": "https://schema.org", "@graph": [ { "@type": "Organization", "@id": "https://dsesecurity.com/#organization", "name": "Detection Systems & Engineering", "alternateName": "DSE Security", "url": "https://dsesecurity.com/", "logo": { "@type": "ImageObject", "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20" } }, { "@type": "Organization", "@id": "https://update.dsesecurity.com/#editorial-team", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/", "parentOrganization": { "@id": "https://dsesecurity.com/#organization" } }, { "@type": "WebSite", "@id": "https://update.dsesecurity.com/#website", "name": "DSE Updates", "alternateName": "DSE Security Knowledge Hub", "url": "https://update.dsesecurity.com/", "inLanguage": "en-US", "publisher": { "@id": "https://dsesecurity.com/#organization" }, "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@type": "WebPage", "@id": "https://update.dsesecurity.com/updates/dse-20260909-348-give-each-query-based-health-signal-one-deliberate-numeric-result/", "url": "https://update.dsesecurity.com/updates/dse-20260909-348-give-each-query-based-health-signal-one-deliberate-numeric-result/", "isPartOf": { "@id": "https://update.dsesecurity.com/#website" }, "lastReviewed": "2026-09-09" }, { "@type": "BreadcrumbList", "@id": "https://update.dsesecurity.com/updates/dse-20260909-348-give-each-query-based-health-signal-one-deliberate-numeric-result/#breadcrumbs", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "DSE Updates", "item": "https://update.dsesecurity.com/" }, { "@type": "ListItem", "position": 2, "name": "Give each query-based health signal one deliberate numeric result", "item": "https://update.dsesecurity.com/updates/dse-20260909-348-give-each-query-based-health-signal-one-deliberate-numeric-result/" } ] }, { "@type": [ "Article", "TechArticle" ], "@id": "https://update.dsesecurity.com/updates/dse-20260909-348-give-each-query-based-health-signal-one-deliberate-numeric-result/#article", "identifier": "https://update.dsesecurity.com/updates/dse-20260909-348-give-each-query-based-health-signal-one-deliberate-numeric-result/", "url": "https://update.dsesecurity.com/updates/dse-20260909-348-give-each-query-based-health-signal-one-deliberate-numeric-result/", "headline": "Give each query-based health signal one deliberate numeric result", "description": "What query result should a Log Analytics or Prometheus health-model signal return?", "abstract": "What query result should a Log Analytics or Prometheus health-model signal return?", "articleBody": "Source facts\nThe Azure Monitor health-model preview requires a KQL log signal to return one numeric value; its PromQL signal has the same single-value requirement. The health-model identity needs permission to read the target telemetry, and the entity must map to a real data source. The configuration then assigns degraded and unhealthy thresholds to the signal. A saved signal definition can be reused for other entities within the same model. Microsoft Learn.\nApplicability\nUse this check when converting an investigative query into an approved preview health signal. First identify the exact entity and observation the number should describe. A useful multirow investigation result is not yet the required scalar signal.\nDSE recommendation\nDefine the entity, time scope and numerical meaning of the signal before reducing its query to one value. Ask the service owner to explain what a threshold crossing means operationally. Keep the selected population visible in the query review so aggregation does not inadvertently combine unrelated entities. Where a definition will be reused, inspect each intended assignment rather than assuming the original query context fits every target.\nVerification\nRun the proposed query under the intended reading identity and inspect the actual result shape and value. Compare it with a separately understood sample of the underlying telemetry. Exercise representative normal and adverse observations in a controlled test, then inspect Graph and Timeline transitions against the chosen thresholds. Preserve the query, assignment and observed value together; successful saving alone does not establish that the number represents the intended entity.\nOfficial references\nMicrosoft Learn: Configure health-model signals preview. Source reviewed September 9, 2026.", "datePublished": "2026-09-10T00:26:08+00:00", "dateModified": "2026-09-10T01:40:04+00:00", "mainEntityOfPage": { "@id": "https://update.dsesecurity.com/updates/dse-20260909-348-give-each-query-based-health-signal-one-deliberate-numeric-result/" }, "inLanguage": "en-US", "isAccessibleForFree": true, "author": { "@type": "Organization", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team" }, "publisher": { "@id": "https://dsesecurity.com/#organization" }, "image": { "@type": "ImageObject", "@id": "https://update.dsesecurity.com/updates/dse-20260909-348-give-each-query-based-health-signal-one-deliberate-numeric-result/#primaryimage", "url": "https://update.dsesecurity.com/assets/editorial/managed-it-social-v2.jpg?v=1.8.20", "contentUrl": "https://update.dsesecurity.com/assets/editorial/managed-it-social-v2.jpg?v=1.8.20", "width": 1200, "height": 630, "caption": "Give each query-based health signal one deliberate numeric result" }, "articleSection": [ "Business Continuity", "IT" ], "keywords": [ "Business Continuity", "IT", "Guide", "Information priority" ], "genre": "Guide", "about": [ { "@type": "Thing", "name": "Business Continuity", "url": "https://update.dsesecurity.com/topic/business-continuity/" }, { "@type": "Thing", "name": "IT", "url": "https://update.dsesecurity.com/topic/it/" } ], "wordCount": 260, "timeRequired": "PT2M", "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usageInfo": "https://update.dsesecurity.com/usage/", "copyrightHolder": { "@id": "https://dsesecurity.com/#organization" }, "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "citation": { "@type": "CreativeWork", "name": "Configure signals in an Azure Monitor health model (preview) - Azure Monitor | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/azure/azure-monitor/health-models/tutorial-signals" } } ] } }