Question

A SOC manager reviews the quarterly observability dashboard for the security operations platform. The 'endpoint process execution' log source shows healthy ingestion volume and low parser error rates, yet the MITRE ATT&CK coverage panel indicates that the Credential Access tactic has zero mapped active detections for endpoint telemetry. Meanwhile, the alert volume dashboard shows a steady stream of Credential Access alerts sourced only from the identity provider logs. Which conclusion is best supported by these observability signals?

Accepted Answer

There is a detection coverage gap: endpoint telemetry is being ingested but no active rules leverage it for Credential Access, leaving that data source underutilized for the tactic.

Answer

The endpoint log source has a telemetry gap and should be re-onboarded because Credential Access alerts are only appearing from identity logs.

Answer

Coverage is adequate because Credential Access alerts are firing, so no further action is needed regardless of which source produces them.

Answer

The parser for endpoint process execution is malfunctioning and dropping Credential Access events before they can be evaluated.