The log source that stopped talking
A quiet dashboard is not always a calm network. When a firewall or server stops sending logs, nothing alerts, because there is no event to alert on.
Track the last successful event for every source and alert on silence and on sharp drops in volume. Then separate the causes: the device is down, the collector failed, the parser is rejecting events, or the device is up but no longer logging. Each needs a different fix.
Watch clock skew too. Events stamped with the wrong time can fall outside detection windows and vanish from investigations. The simplest acceptance test is also the best: stop a feed on purpose and measure how long detection takes.
Keep reading
What “local-only” should mean in a SOC
Many platforms claim on-premises operation yet still lean on the cloud. Three questions that reveal the difference.
12 November 2026 · 1 min read
Security operationsSizing a SIEM: why events per second is only the start
Licence size, storage and hardware all depend on more than one number.
7 November 2026 · 1 min read
Security operationsAutomating response without losing control
Playbooks save time, but the wrong automation can cause outages. Where to keep a human in the loop.
6 November 2026 · 1 min read