# Give each query-based health signal one deliberate numeric result

> What query result should a Log Analytics or Prometheus health-model signal return?

- Canonical URL: https://update.dsesecurity.com/updates/dse-20260909-348-give-each-query-based-health-signal-one-deliberate-numeric-result/
- Publisher: Detection Systems & Engineering (DSE Security)
- Author: DSE Security Editorial Team
- Published: 2026-09-10T00:26:08+00:00
- Modified: 2026-09-10T01:40:04+00:00
- Last reviewed by DSE: 2026-09-09
- Resource type: Guide
- DSE priority: Information
- Topics: Business Continuity, IT
- Reading time: 2 minutes

## What you need to know

What query result should a Log Analytics or Prometheus health-model signal return?

## Potentially affected

Query-based signals in the Azure Monitor health-model preview using Log Analytics or Azure Monitor workspaces.

## DSE recommendation

Define the entity, time scope and numerical meaning of the signal before reducing its query to one value.

## Article

## Source facts

The Azure Monitor health-model preview requires a KQL log signal to return one numeric value; its PromQL signal has the same single-value requirement. The health-model identity needs permission to read the target telemetry, and the entity must map to a real data source. The configuration then assigns degraded and unhealthy thresholds to the signal. A saved signal definition can be reused for other entities within the same model. [Microsoft Learn](https://learn.microsoft.com/en-us/azure/azure-monitor/health-models/tutorial-signals).

## Applicability

Use this check when converting an investigative query into an approved preview health signal. First identify the exact entity and observation the number should describe. A useful multirow investigation result is not yet the required scalar signal.

## DSE recommendation

Define the entity, time scope and numerical meaning of the signal before reducing its query to one value. Ask the service owner to explain what a threshold crossing means operationally. Keep the selected population visible in the query review so aggregation does not inadvertently combine unrelated entities. Where a definition will be reused, inspect each intended assignment rather than assuming the original query context fits every target.

## Verification

Run the proposed query under the intended reading identity and inspect the actual result shape and value. Compare it with a separately understood sample of the underlying telemetry. Exercise representative normal and adverse observations in a controlled test, then inspect Graph and Timeline transitions against the chosen thresholds. Preserve the query, assignment and observed value together; successful saving alone does not establish that the number represents the intended entity.

## Official references

[Microsoft Learn: Configure health-model signals preview](https://learn.microsoft.com/en-us/azure/azure-monitor/health-models/tutorial-signals). Source reviewed September 9, 2026.

## Primary reference

- Name: Configure signals in an Azure Monitor health model (preview) - Azure Monitor | Microsoft Learn
- Authority: Microsoft Learn
- URL: https://learn.microsoft.com/en-us/azure/azure-monitor/health-models/tutorial-signals
- Source publication date: Not stated by the source

## Citation and use

Preferred citation: “Give each query-based health signal one deliberate numeric result,” DSE Security, https://update.dsesecurity.com/updates/dse-20260909-348-give-each-query-based-health-signal-one-deliberate-numeric-result/
Publishing principles: https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/
Usage and citation policy: https://update.dsesecurity.com/usage/
Copyright © 2026 Detection Systems & Engineering. All rights reserved.