Queries, collection and verifiable restoration

Source, destination and interval

Platform metrics and Activity Log are collected automatically through their respective mechanisms. Resource logs need appropriate diagnostic settings. Seeing portal metrics does not prove log categories reached the workspace.

Confirm source, categories, destination, interval and operator authorization. A table may appear only after data arrival. Increasing retention does not create events never sent; compare configuration with actually received records.

Meaningful aggregation

Before summarizing values, define population and unit. An average mixing CPU percentages and memory bytes is not overall health. Separate relevant CounterName and Computer values.

To count errors per five-minute window, filter errors and use intervals such as bin(TimeGenerated, 5m). Grouping by exact timestamp can split a window into small groups and hide that the total exceeded the threshold. Distinguish count, average and latest value.

Choosing restoration

Replace existing replaces disks on a VM that still exists. If the VM was deleted, use a compatible option such as creating a new VM or restoring disks and rebuilding configuration. For a drill that must not modify production, choose separate test identity and networking with an eligible recovery point.

A point’s name and technical job completion do not establish that application and data meet functional criteria.

Operational acceptance

Block duplicate external effects before testing transactions in a recovered environment. Confirm data state, credentials, networking, team access and a representative result. In the exercise analysis, twelve errors at 10:01 and eight at 10:04 belong to the same window aligned at 10:00: twenty, above fifteen.

In the recovery drill, a created and reachable VM still needs data and operational criteria. Record each piece of evidence’s limits instead of generalizing a green signal.

Common pitfalls

Avoid aggregating incompatible units, treating absent logs as absent incidents, or replacing production disks in a drill requiring isolation.