Your SOC platform team publishes a weekly 'log source health' dashboard. A recent phishing incident revealed that a critical mail-gateway log source had stopped forwarding events three days before the attack, yet the dashboard showed the source as 'healthy' the entire week. On investigation, the dashboard's health status is based solely on cumulative event count over the trailing 7 days, which remained high due to a large burst earlier in the week. Which metric change would MOST reliably surface this type of gap going forward?