All playbooks
Detection engineering · Detection and platform engineers
Missing telemetry investigation
Find whether collection, parsing, mapping or query scope caused a gap.
A quiet rule can mean no activity, missing collection, empty fields or a query aimed at the wrong place.
What this does not establish
- A documented schema does not prove a field is populated on the affected hosts.
- Zero matches does not prove the behavior never happened.
- One working host does not establish coverage for the fleet.
0 of 8 ticked
Selected step
FrameStep 1 of 8
Define the observation and affected scope.
List the events and fields the rule needs
- Record source, event type, fields and expected value types.
- Specify asset groups and the time window being assessed.