# Check missing summary-rule intervals before accepting a Log Analytics trend

> How should an operator distinguish a quiet interval from an unsuccessful summary-rule bin?

- Canonical URL: https://update.dsesecurity.com/updates/dse-20260909-006-check-missing-summary-rule-intervals-before-accepting-a-log-analytics-trend/
- Publisher: Detection Systems & Engineering (DSE Security)
- Author: DSE Security Editorial Team
- Published: 2026-09-10T00:31:50+00:00
- Modified: 2026-09-10T00:31:59+00:00
- Last reviewed by DSE: 2026-09-09
- Resource type: Guide
- DSE priority: Information
- Topics: Business Continuity, Networks & Infrastructure
- Reading time: 2 minutes

## What you need to know

How should an operator distinguish a quiet interval from an unsuccessful summary-rule bin?

## Potentially affected

Log Analytics workspaces using summary rules in the public cloud.

## DSE recommendation

Reconcile successful bin execution with the reporting interval before accepting an aggregate trend.

## Article

## Source facts

Summary rules periodically aggregate workspace logs into a custom table. Enabling the workspace’s Summary Logs diagnostic category sends execution outcomes to LASummaryLogs. A failed bin receives ten retry attempts within eight hours; after those attempts are exhausted, that bin is skipped. Microsoft also documents a hold after eight consecutive bin retries. [Microsoft Learn](https://learn.microsoft.com/en-us/azure/azure-monitor/logs/summary-rules).

The source provides a completeness query using successful runs and BinStartTime. A manually retried run is identified by its failed bin’s start time, not an arbitrary reporting timestamp. [Microsoft Learn](https://learn.microsoft.com/en-us/azure/azure-monitor/logs/summary-rules).

## Applicability

Apply this review to Log Analytics workspaces using summary rules in the public cloud. Summary rules are unavailable outside that cloud scope. [Microsoft Learn](https://learn.microsoft.com/en-us/azure/azure-monitor/logs/summary-rules). Keep the rule’s configured bin size and the report’s time range in the review record. Treat completeness as a question to establish, not something implied by an attractive chart.

## DSE recommendation

DSE recommends checking execution coverage before interpreting a drop in summarized activity. Assign missing intervals to a separate exception list, with their rule name and bin start. Ask the rule owner to investigate failed execution before requesting a rerun. Do not quietly replace unknown intervals with zero in a management report; label the uncertainty until evidence resolves it.

## Verification

For an approved sample period, compare the expected interval sequence with successful execution records and the destination results. Preserve the missing-bin list, any retry request, and its observed outcome. Have a second reviewer confirm that the final trend distinguishes measured values from intervals that remain unverified.

## Official references

[Microsoft Learn: Aggregate data with summary rules](https://learn.microsoft.com/en-us/azure/azure-monitor/logs/summary-rules).

## Primary reference

- Name: Aggregate data in a Log Analytics workspace with summary rules - Azure Monitor | Microsoft Learn
- Authority: Microsoft Learn
- URL: https://learn.microsoft.com/en-us/azure/azure-monitor/logs/summary-rules
- Source publication date: Not stated by the source

## Citation and use

Preferred citation: “Check missing summary-rule intervals before accepting a Log Analytics trend,” DSE Security, https://update.dsesecurity.com/updates/dse-20260909-006-check-missing-summary-rule-intervals-before-accepting-a-log-analytics-trend/
Publishing principles: https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/
Usage and citation policy: https://update.dsesecurity.com/usage/
Copyright © 2026 Detection Systems & Engineering. All rights reserved.