{ "api_version": "1", "kind": "dse_post", "self": "https://update.dsesecurity.com/api/v1/posts/dse-20260909-382-keep-service-fabric-health-output-filters-separate-from-evaluation-policy/", "item": { "id": "https://update.dsesecurity.com/updates/dse-20260909-382-keep-service-fabric-health-output-filters-separate-from-evaluation-policy/", "slug": "dse-20260909-382-keep-service-fabric-health-output-filters-separate-from-evaluation-policy", "url": "https://update.dsesecurity.com/updates/dse-20260909-382-keep-service-fabric-health-output-filters-separate-from-evaluation-policy/", "alternate_urls": { "markdown": "https://update.dsesecurity.com/updates/dse-20260909-382-keep-service-fabric-health-output-filters-separate-from-evaluation-policy.md", "json": "https://update.dsesecurity.com/api/v1/posts/dse-20260909-382-keep-service-fabric-health-output-filters-separate-from-evaluation-policy/" }, "title": "Keep Service Fabric health output filters separate from evaluation policy", "summary": "Can a filtered Service Fabric health result still reflect events that are absent from its displayed list?", "format": { "slug": "guide", "name": "Guide" }, "priority": { "slug": "info", "name": "Information" }, "featured": false, "image": { "theme": "continuity-recovery", "label": "Continuity & recovery", "alt": "Paired infrastructure paths converging on a stable recovered service.", "card_url": "https://update.dsesecurity.com/assets/editorial/continuity-recovery-card.webp?v=1.8.20", "hero_url": "https://update.dsesecurity.com/assets/editorial/continuity-recovery-hero.webp?v=1.8.20", "social_url": "https://update.dsesecurity.com/assets/editorial/continuity-recovery-social-v2.jpg?v=1.8.20", "width": 2400, "height": 1350 }, "topics": [ { "slug": "business-continuity", "name": "Business Continuity", "url": "https://update.dsesecurity.com/topic/business-continuity/" }, { "slug": "it", "name": "IT", "url": "https://update.dsesecurity.com/topic/it/" } ], "author": { "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team", "type": "Organization" }, "publisher": { "name": "Detection Systems & Engineering", "url": "https://dsesecurity.com/" }, "published_at": "2026-09-10T00:25:34+00:00", "modified_at": "2026-09-10T02:01:56+00:00", "reviewed_on": "2026-09-09", "reading_minutes": 1, "word_count": 219, "potentially_affected": "Service Fabric cluster health queries with event, node or application output filters.", "dse_recommendation": "DSE recommends recording the query's output filters and evaluation policies as separate review inputs.", "primary_source": { "name": "How to view Azure Service Fabric entities' aggregated health - Azure Service Fabric | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/azure/service-fabric/service-fabric-view-entities-aggregated-health", "published_on": null, "authority": "Microsoft Learn" }, "publishing_principles": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usage_info": "https://update.dsesecurity.com/usage/", "copyright_notice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "content_html": "

Source facts

\n

Service Fabric’s cluster-health filters limit the events, nodes and applications returned, but all of them still participate in aggregated health evaluation. Health policies, rather than those output filters, govern the evaluation. Unhealthy evaluations show the first reason for the resulting state and may omit other contributing events. Microsoft Learn.

\n

Applicability

\n

Apply this distinction when a reduced response seems inconsistent with the cluster’s reported state. Compare the selected output with the full evaluation scope. Do not treat an empty filtered list as evidence that the underlying cluster has no unhealthy entities.

\n

DSE recommendation

\n

DSE recommends recording the query’s output filters and evaluation policies as separate review inputs. Preserve the policy settings when comparing two queries so an output change is not confused with a changed health decision. Use the initial unhealthy evaluation to choose where to investigate, then examine the relevant child entities and their reports rather than closing the incident after the first explanation.

\n

Verification

\n

In a read-only comparison, request the same cluster under the same policies with broader and narrower output filters. Check the returned entities and aggregate state separately. Drill into the reported unhealthy children to collect other contributing events. Retain the query parameters with each result; a short response should remain traceable to the scope it omitted.

\n

Official references

\n

Microsoft Learn. Source retrieved September 9, 2026.

", "content_text": "Source facts\nService Fabric’s cluster-health filters limit the events, nodes and applications returned, but all of them still participate in aggregated health evaluation. Health policies, rather than those output filters, govern the evaluation. Unhealthy evaluations show the first reason for the resulting state and may omit other contributing events. Microsoft Learn.\nApplicability\nApply this distinction when a reduced response seems inconsistent with the cluster’s reported state. Compare the selected output with the full evaluation scope. Do not treat an empty filtered list as evidence that the underlying cluster has no unhealthy entities.\nDSE recommendation\nDSE recommends recording the query’s output filters and evaluation policies as separate review inputs. Preserve the policy settings when comparing two queries so an output change is not confused with a changed health decision. Use the initial unhealthy evaluation to choose where to investigate, then examine the relevant child entities and their reports rather than closing the incident after the first explanation.\nVerification\nIn a read-only comparison, request the same cluster under the same policies with broader and narrower output filters. Check the returned entities and aggregate state separately. Drill into the reported unhealthy children to collect other contributing events. Retain the query parameters with each result; a short response should remain traceable to the scope it omitted.\nOfficial references\nMicrosoft Learn. Source retrieved September 9, 2026.", "content_markdown": "## Source facts\n\nService Fabric’s cluster-health filters limit the events, nodes and applications returned, but all of them still participate in aggregated health evaluation. Health policies, rather than those output filters, govern the evaluation. Unhealthy evaluations show the first reason for the resulting state and may omit other contributing events. [Microsoft Learn](https://learn.microsoft.com/en-us/azure/service-fabric/service-fabric-view-entities-aggregated-health).\n\n## Applicability\n\nApply this distinction when a reduced response seems inconsistent with the cluster’s reported state. Compare the selected output with the full evaluation scope. Do not treat an empty filtered list as evidence that the underlying cluster has no unhealthy entities.\n\n## DSE recommendation\n\nDSE recommends recording the query’s output filters and evaluation policies as separate review inputs. Preserve the policy settings when comparing two queries so an output change is not confused with a changed health decision. Use the initial unhealthy evaluation to choose where to investigate, then examine the relevant child entities and their reports rather than closing the incident after the first explanation.\n\n## Verification\n\nIn a read-only comparison, request the same cluster under the same policies with broader and narrower output filters. Check the returned entities and aggregate state separately. Drill into the reported unhealthy children to collect other contributing events. Retain the query parameters with each result; a short response should remain traceable to the scope it omitted.\n\n## Official references\n\n[Microsoft Learn](https://learn.microsoft.com/en-us/azure/service-fabric/service-fabric-view-entities-aggregated-health). Source retrieved September 9, 2026." }, "json_ld": { "@context": "https://schema.org", "@graph": [ { "@type": "Organization", "@id": "https://dsesecurity.com/#organization", "name": "Detection Systems & Engineering", "alternateName": "DSE Security", "url": "https://dsesecurity.com/", "logo": { "@type": "ImageObject", "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20" } }, { "@type": "Organization", "@id": "https://update.dsesecurity.com/#editorial-team", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/", "parentOrganization": { "@id": "https://dsesecurity.com/#organization" } }, { "@type": "WebSite", "@id": "https://update.dsesecurity.com/#website", "name": "DSE Updates", "alternateName": "DSE Security Knowledge Hub", "url": "https://update.dsesecurity.com/", "inLanguage": "en-US", "publisher": { "@id": "https://dsesecurity.com/#organization" }, "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@type": "WebPage", "@id": "https://update.dsesecurity.com/updates/dse-20260909-382-keep-service-fabric-health-output-filters-separate-from-evaluation-policy/", "url": "https://update.dsesecurity.com/updates/dse-20260909-382-keep-service-fabric-health-output-filters-separate-from-evaluation-policy/", "isPartOf": { "@id": "https://update.dsesecurity.com/#website" }, "lastReviewed": "2026-09-09" }, { "@type": "BreadcrumbList", "@id": "https://update.dsesecurity.com/updates/dse-20260909-382-keep-service-fabric-health-output-filters-separate-from-evaluation-policy/#breadcrumbs", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "DSE Updates", "item": "https://update.dsesecurity.com/" }, { "@type": "ListItem", "position": 2, "name": "Keep Service Fabric health output filters separate from evaluation policy", "item": "https://update.dsesecurity.com/updates/dse-20260909-382-keep-service-fabric-health-output-filters-separate-from-evaluation-policy/" } ] }, { "@type": [ "Article", "TechArticle" ], "@id": "https://update.dsesecurity.com/updates/dse-20260909-382-keep-service-fabric-health-output-filters-separate-from-evaluation-policy/#article", "identifier": "https://update.dsesecurity.com/updates/dse-20260909-382-keep-service-fabric-health-output-filters-separate-from-evaluation-policy/", "url": "https://update.dsesecurity.com/updates/dse-20260909-382-keep-service-fabric-health-output-filters-separate-from-evaluation-policy/", "headline": "Keep Service Fabric health output filters separate from evaluation policy", "description": "Can a filtered Service Fabric health result still reflect events that are absent from its displayed list?", "abstract": "Can a filtered Service Fabric health result still reflect events that are absent from its displayed list?", "articleBody": "Source facts\nService Fabric’s cluster-health filters limit the events, nodes and applications returned, but all of them still participate in aggregated health evaluation. Health policies, rather than those output filters, govern the evaluation. Unhealthy evaluations show the first reason for the resulting state and may omit other contributing events. Microsoft Learn.\nApplicability\nApply this distinction when a reduced response seems inconsistent with the cluster’s reported state. Compare the selected output with the full evaluation scope. Do not treat an empty filtered list as evidence that the underlying cluster has no unhealthy entities.\nDSE recommendation\nDSE recommends recording the query’s output filters and evaluation policies as separate review inputs. Preserve the policy settings when comparing two queries so an output change is not confused with a changed health decision. Use the initial unhealthy evaluation to choose where to investigate, then examine the relevant child entities and their reports rather than closing the incident after the first explanation.\nVerification\nIn a read-only comparison, request the same cluster under the same policies with broader and narrower output filters. Check the returned entities and aggregate state separately. Drill into the reported unhealthy children to collect other contributing events. Retain the query parameters with each result; a short response should remain traceable to the scope it omitted.\nOfficial references\nMicrosoft Learn. Source retrieved September 9, 2026.", "datePublished": "2026-09-10T00:25:34+00:00", "dateModified": "2026-09-10T02:01:56+00:00", "mainEntityOfPage": { "@id": "https://update.dsesecurity.com/updates/dse-20260909-382-keep-service-fabric-health-output-filters-separate-from-evaluation-policy/" }, "inLanguage": "en-US", "isAccessibleForFree": true, "author": { "@type": "Organization", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team" }, "publisher": { "@id": "https://dsesecurity.com/#organization" }, "image": { "@type": "ImageObject", "@id": "https://update.dsesecurity.com/updates/dse-20260909-382-keep-service-fabric-health-output-filters-separate-from-evaluation-policy/#primaryimage", "url": "https://update.dsesecurity.com/assets/editorial/continuity-recovery-social-v2.jpg?v=1.8.20", "contentUrl": "https://update.dsesecurity.com/assets/editorial/continuity-recovery-social-v2.jpg?v=1.8.20", "width": 1200, "height": 630, "caption": "Keep Service Fabric health output filters separate from evaluation policy" }, "articleSection": [ "Business Continuity", "IT" ], "keywords": [ "Business Continuity", "IT", "Guide", "Information priority" ], "genre": "Guide", "about": [ { "@type": "Thing", "name": "Business Continuity", "url": "https://update.dsesecurity.com/topic/business-continuity/" }, { "@type": "Thing", "name": "IT", "url": "https://update.dsesecurity.com/topic/it/" } ], "wordCount": 219, "timeRequired": "PT1M", "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usageInfo": "https://update.dsesecurity.com/usage/", "copyrightHolder": { "@id": "https://dsesecurity.com/#organization" }, "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "citation": { "@type": "CreativeWork", "name": "How to view Azure Service Fabric entities' aggregated health - Azure Service Fabric | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/azure/service-fabric/service-fabric-view-entities-aggregated-health" } } ] } }