Good evening folks, we’re scratching our heads a little bit and hoping the community can help ease some concerns!

We have a long-standing Sentinel deployment in Azure (pre-Defender native) and are seeing mass ingestion failure in the attached Log Analytics workspace. All services are in UK South region.

This appears to be affecting all log sources to a varying extent, including Microsoft-native connectors and logs forwarded from our on-premises syslog forwarders.

Bulk of issues appear to have started from between 12:00-13:00 UTC today, with sporadic ingestion spikes around 15:00 UTC and 19:00 UTC.

Not seeing any associated service disruption in our tenant, which I’d have expected to have if this were a widespread issue. We do have some correlation with an alert received from a third-party SOC we engage with for one of our clients, relating to missed heartbeats, which is naturally leading us to think it’s an issue beyond our deployment.

Anybody else seeing issues in their LAW(s)?