In SOC log-source coverage, what is the difference between an enrolled host and a reporting host?

## Two different facts A log-source coverage number is built from two claims that people routinely conflate. - **Enrolled** — a configuration statement. An agent is installed, a forwarder is configured, a cloud audit trail is switched on, a device is pointed at a syslog collector. The evidence lives in a management console, a deployment tool, or a licence count. - **Reporting** — an observed statement. Events attributable to that source were indexed by the SIEM within a stated window, at a volume consistent with what that source normally produces. Enrolment is a promise. Reporting is delivery. Only the second is evidence, because only the second was produced by the pipeline you will actually search during an investigation. ## Why the gap opens The distance between the two numbers is never zero, and the causes are mundane rather than exotic: - the host is powered off, in a drawer, on a shelf, or was rebuilt and never re-enrolled; - the agent is running but the underlying audit source is not — Windows audit policy not configured for the categories the rules need, `auditd` rules never loaded, a cloud audit trail enabled in one region only; - the log file the shipper tails was rotated to a new inode, or moved when a package upgraded; - the network path changed: a new egress rule, a route, an expired certificate on the collector's TLS listener; - back pressure — the shipper's disk queue filled and it is dropping, or an index-side filter or volume cap is discarding the events after they arrive; - the source sends *some* channels and not others, so it looks alive while the specific data your detections need has stopped. None of these change the console. All of them change what you can search. ## Measuring reporting honestly The basic construct is a **last-seen table**: one row per source, carrying the most recent event time and the most recent index time, plus the volume in the last hour and in the same hour last week. - **Event time** is the timestamp inside the record. It can be wrong — a skewed host clock, or a backlog being replayed after an outage will produce old event times arriving now. - **Index time** is when the SIEM actually received and stored it. This is what tells you whether the path works right now. Compare them. Current event times with a stale index time means the pipeline has stalled or is lagging. Current index time with event times eleven days old means a backlog is draining. Alert on index time; investigate with both. Last-seen alone catches total silence only. A source can keep one channel flowing while another dies, so its last-seen stays fresh while half its telemetry is gone. That is why per-source, per-channel **volume** against that source's own baseline — with an absolute floor for sources that are normally sparse — is the stronger check. ## The denominator A percentage needs a bottom half. The CMDB, the identity directory, DHCP or DNS lease records, and network-authentication logs each yield a different host count for the same estate, and the hosts that exist in one list and not another are exactly the ones nobody is collecting from. Whatever list you pick, name it when you publish the number, and reconcile against at least one independent source. Resist the temptation to remove silent hosts from the denominator. That is the one edit that always raises the percentage and always lowers the truth. ## What silence proves The direction of the claim matters. Records arriving prove activity happened. Records **not** arriving prove only that you have no records. It does not prove the host was idle, it does not prove nothing malicious ran, and it does not prove the host still exists. A host that has been silent for six days is an unexplained gap to be worked, not a clean host to be ticked off — and it is also not, on that evidence alone, a compromised one. ## What an interviewer is listening for That you distinguish configuration from observation; that you know coverage is computed from arrivals over a named denominator; that you can list two or three concrete ways an installed agent stops delivering; and that you say out loud that absence of data is missing evidence rather than good news.