# Detect if sensor doesn't send data within a certain timeframe

**URL:** <https://community.limacharlie.com/t/detect-if-sensor-doesnt-send-data-within-a-certain-timeframe/332>\
**Category:** Feature Requests\
**Created:** [June 4, 2025, 7:28pm UTC](https://community.limacharlie.com/t/detect-if-sensor-doesnt-send-data-within-a-certain-timeframe/332 "2025-06-04T19:28:36Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![kwestin](https://yyz1.discourse-cdn.com/flex033/user_avatar/community.limacharlie.com/kwestin/32/98_2.png) [@kwestin](https://community.limacharlie.com/u/kwestin)\
**Post date:** [June 4, 2025, 7:28pm UTC](https://community.limacharlie.com/t/detect-if-sensor-doesnt-send-data-within-a-certain-timeframe/332/1 "2025-06-04T19:28:36Z")

</div>

Request from customers to have the ability to trigger alerts if a sensor has not sent data within a certain time interval. This is important to be able to detect potential tampering as well as identify if a sensor is offline due to system issue.

---

<div class="post-metadata">

**Author:** ![Alan.Shearer](https://avatars.discourse-cdn.com/v4/letter/a/22d042/32.png) [@Alan.Shearer](https://community.limacharlie.com/u/Alan.Shearer)\
**Post date:** [June 8, 2025, 11:18pm UTC](https://community.limacharlie.com/t/detect-if-sensor-doesnt-send-data-within-a-certain-timeframe/332/2 "2025-06-08T23:18:43Z")

</div>

Voting for this one too.

---

<div class="post-metadata">

**Author:** ![maximelb](https://yyz1.discourse-cdn.com/flex033/user_avatar/community.limacharlie.com/maximelb/32/13_2.png) [@maximelb](https://community.limacharlie.com/u/maximelb)\
**Post date:** [June 9, 2025, 12:20am UTC](https://community.limacharlie.com/t/detect-if-sensor-doesnt-send-data-within-a-certain-timeframe/332/3 "2025-06-09T00:20:04Z")

</div>

As a stop-gab solution for those looking, here’s a playbook that you can use to achieve that:

```python
import limacharlie
import time

# LimaCharlie D&R Rule to trigger this playbook
# every 30 minutes.
# detection:
# target: schedule
# event: 30m_per_org
# op: exists
# path: /
# response:
# - action: extension request
# extension name: ext-playbook
# extension action: run_playbook
# extension request:
# name: check-missing-data
# credentials: hive://secret/playbook-missing-data-creds

SENSOR_SELECTOR = "plat == windows"
DATA_WITHIN = 10 * 60 * 1000 # 10 minutes

def notify_missing_data(sdk: limacharlie.Limacharlie, sensor: limacharlie.Sensor):
    # TODO: Implement this, but it's optional if all you want is a detection
    # since those will be generated automatically.
    pass

def get_relevant_sensors(sdk: limacharlie.Limacharlie) -> list[limacharlie.Sensor]:
    sensors = sdk.sensors(selector=SENSOR_SELECTOR)
    relevant_sensors = []
    for sensor in sensors:
        relevant_sensors.append(sensor)
    return relevant_sensors

def playbook(sdk: limacharlie.Limacharlie, data: dict) -> dict | None:
    # Get the sensors we care about.
    relevant_sensors = get_relevant_sensors(sdk)

    stopped_sensors = []

    # For each sensor, check if we've received data within that time period.
    for sensor in relevant_sensors:
        # To do that we will get the data overview and see if a recent time stamp is present.
        data_overview = sensor.getHistoricOverview(int(time.time() - DATA_WITHIN), int(time.time()))
        after = int(time.time() * 1000) - DATA_WITHIN
        for timestamp in data_overview:
            if timestamp > after:
                print(f"Data received for sensor {sensor.sid} at {timestamp}")
                break
        else:
            print(f"No data received for sensor {sensor.sid} in the last {DATA_WITHIN} seconds")
            notify_missing_data(sdk, sensor)
            stopped_sensors.append(sensor)
    
    # Report a detection for stopped sensors.
    if stopped_sensors:
        return {"detection":{
            "stopped_sensors": [sensor.sid for sensor in stopped_sensors]
        }}
    return None

```

I’m curious if there’s a specific way folks would like to be notified of those. A new LC event? I could add a webhook adapter example if it helps.