Investigators blame a 40-minute gap in a host's forwarded events on the intruder, but your deployment job stopped the agent — how do you settle it?

## The situation, honestly stated An intrusion is confirmed on a host you manage. The responders' timeline has a 40-minute hole in the forwarded events, inside the window they care about, and the natural reading of a hole in telemetry during an intrusion is that someone made it. You believe your software-deployment job restarted the collection agent inside a Tuesday change window. You have a ticket. A ticket is an assertion by the person being asked to explain themselves, and no competent responder should accept it as evidence. Your job is to hand over things that can be checked without trusting you. ## Recording and shipping are different gaps This is the distinction that decides the case, and most people conflate the two. | what stopped | still recorded locally? | reaches the collector? | |---|---|---| | the forwarder or collection agent | yes — the Event Log service is a separate service | no, until it restarts and drains | | the Event Log service, or auditing itself | no | nothing to send | A stopped agent produces a **shipping** gap. The host went on writing to its channels the whole time. So the first and best move is not an argument at all: collect those 40 minutes from the host's local channel, where they very likely still are. They are only gone if the channel has since wrapped, which depends on the host's event rate and channel size. If they are there, the gap closes and the timeline is whole, and nobody has to believe anyone. ## Independent corroboration for the change claim If the local copy is gone, the claim still has to stand on evidence other than the ticket: - **The agent service's own state changes.** The Service Control Manager writes service stop and start records into the System log (Event ID 7036 reports a service entering the running or stopped state). Those records are in a different channel from the one that went quiet, and they bracket the gap with timestamps. A stop at the start of the gap and a start at its end is strong corroboration. - **The deployment ring.** If the same package went to two hundred hosts in a batch, the same gap should appear on many of them at overlapping minutes. Fleet-wide correlation is very hard to fake and easy for a responder to check independently. Conversely, a gap on this one host alone, at those exact minutes, is a finding against the benign explanation. - **The deployment system's own records.** Job history and package-install logs on the deployment server, pulled by the responder rather than exported by you, are independent of the ticket. - **The agent's own install or upgrade log** on the host, which typically records the service restart it performed. Offer all of it, and offer access rather than exports. The person under suspicion should not be the sole custodian of their own exculpatory evidence — not because anyone assumes bad faith, but because evidence someone collected about themselves is worth less later, when the claim has to be defended to somebody who was not in the room. ## The conclusion discipline: two claims, not one Even when the change explanation is fully corroborated, keep two statements separate: 1. **The gap has a benign cause.** Corroborated. 2. **Nothing hostile happened during those minutes.** Not established, and not establishable from a change record. An explained gap is still an unobserved gap. Deployment windows are published, predictable and often visible from inside the estate, so an intruder acting during one is not exotic; and an intruder with local rights can stop a service themselves, which would look much the same on this one host but would not reproduce across the ring. Conflating the two claims is how a real intrusion window gets written off as a change artefact. ## How this lands in the report If the local channel yields the missing records, say so and close the gap. If it does not, the report names those 40 minutes as time for which no copy exists anywhere, states the corroborated benign cause of the gap, and explicitly does not claim the window was clean. Scoping treats the interval as unknown, and the watch for re-entry after eradication is written knowing there is a slice of the intrusion nobody ever observed. That is a stronger, more defensible report than one that quietly implies full coverage — and it is the version that survives being read back to you months later. ## The relationship, not just the evidence One last practical note from this side of the table: cooperating fast is worth more than being right. Volunteering the ring correlation and the deployment logs before being asked converts you from a suspect into a source, and it is usually the fastest route to a timeline everyone believes.