Question

As a Security Operations Engineer, you maintain a coverage dashboard that shows all 4,200 corporate endpoints reporting EDR telemetry into your SIEM. Alert volumes look healthy and log freshness is under 5 minutes fleet-wide. However, during a recent incident, a detection for credential dumping (LSASS access) never fired on the compromised host, even though the same rule fired reliably on other hosts. The host was actively sending process and network events at the time. What is the MOST likely observability gap to investigate first?

Accepted Answer

The host is running an outdated EDR sensor version that does not collect the specific telemetry (e.g., process handle-access events) the rule depends on, creating a per-field coverage gap not visible in log-freshness or volume metrics

Answer

The SIEM's overall ingestion volume exceeded its daily license quota, causing events from that host to be silently dropped

Answer

The detection rule was in test/disabled state globally and did not fire on any host

Answer

The endpoint's system clock was skewed, so all events fell outside the rule's correlation window