Question

During a quarterly observability review, a SOC engineer notices that the endpoint detection rules covering a critical business unit's Windows fleet fire far less often than expected. The log source shows as 'onboarded' in the platform, ingestion volume graphs show steady EPS, and no forwarder health alerts are active. However, a MITRE ATT&CK coverage heatmap shows techniques for that fleet dropped from 'covered' to 'partial' over the last 30 days. What is the most likely root cause the engineer should investigate first?

Accepted Answer

A parser change caused a subset of the Windows event fields to stop mapping to UDM, so events ingest but no longer satisfy the detection rules' field conditions

Answer

The forwarder was decommissioned, halting all telemetry from the fleet

Answer

The detection rules were disabled by an administrator during the review period

Answer

Data retention policies expired and purged the historical Windows logs