A security operations engineer is building an observability dashboard to measure the health of telemetry feeding the SIEM. For a critical Windows endpoint log source that is confirmed onboarded and parsing successfully, several detection rules that depend on the UDM field 'principal.process.command_line' are firing far less often than expected. Ingestion volume and log freshness metrics both appear normal. Which metric should the engineer add to the dashboard to best diagnose whether this detection gap is caused by an underlying telemetry quality problem?