Telemetry & Log Sources

Late arrival breaks scheduled detections that scan a rolling window of event time, skews any timeline that mixes fast and slow sources, and makes the live picture of a host stale while you are deciding what to do about it.

Walk the chain backwards. The session identifier in the entry links to the role-assumption call that created it, and that call's own identity is the caller. Repeat for each hop until you reach an identity authenticated by a human login.

That item access is not recorded in this tenant, so there is no evidence either way. An absent record proves nothing when the events were never generated. Report the mailbox as exposed for the window the intruder's session was live.

Command-line capture on process creation first: it is the cheapest switch and turns a program name into a statement of what was asked of it. Script-block logging second, on the interpreters that matter. Module logging last, and rarely fleet-wide.

Name the denominator first — which authoritative asset list the figure is over — and prove the numerator from events indexed in a stated window, not agents enrolled. Present the missing six percent as a named, owned list.

Measure each source's offset using events that two sources both recorded, convert everything to UTC while keeping the raw fields, order by causality where the offsets overlap, and state the residual uncertainty instead of a false-precise second.

A change record is a claim, not evidence. Corroborate it with the agent service's own stop and start records, the same gap on other hosts in that deployment ring, and the host's local channel, which kept recording while shipping stopped.

Hunt every identity-creating and credential-adding event made inside the compromise window: new access keys, secrets or certificates added to an existing application or service principal, new service accounts, and roles newly trusted by an outside party.

MFA held, and it is the wrong question. The user authenticated, then granted a third-party app a delegated mail-read scope; the app holds its own token under that grant and never faces a challenge.

That specific accesses happened, through a specific channel, at specific times — not that anything wrong occurred. Entitled access is normal, so any claim rests on event type, volume, timing and channel measured against that person's own history.

A shared CDN hostname is the same string for sanctioned and hostile traffic, so the name discriminates nothing. What the proxy record still gives you is the client side: which host, which user, and how rare that name is for that population.

Approval must leave the security line entirely — a standing alternate such as internal audit, privacy or the general counsel's office. The subject also administers the tooling, so evidence, retention and the audit trail must move beyond their control before collection starts.

Stop selling insurance and sell answerability: name the case questions the extra months make answerable and nothing else can. Offer an asymmetric horizon as the trade, and write down in advance what the shortened branch costs.

Publish both names for a fixed, announced window, migrate the consumers you can enumerate, then remove the old name on a stated date. A silent cut breaks content nobody warned; a permanent alias quietly becomes the schema.

Split the objection. Execve-only auditing is far cheaper than the broad syscall rule sets people picture, and most of the volume is your own configuration management. Negotiate a measured rule, then get any accepted gap named and owned.