Telemetry: what Signal could not see
On this page
Half of Signal's answer is what it could not see. Telemetry, source health and rule outcomes tell you how far a run - and its silence - can be trusted.
Unknown is never "no". A rule that could not run is not run, never clear.
Three places that say what was missing
Where | What it says |
|---|---|
Telemetry (per module) | Whether a source of evidence is there: an audit setting, a logging setting, a log's health, a Windows feature, a protection. |
Source health (the run's | For every evidence type: read, partly read, not read or unavailable - with why, how many records, and the time covered. |
Rule outcomes (each module's rule catalog) | Every rule: flagged, clear, or not run with a reason. |
Telemetry
Each telemetry item has a state and a category.
State | Meaning |
|---|---|
| The source is there and recording. |
| The source is there but turned off: Windows did not record this. |
| The host does not have this source at all: no web site, no firewall log file, a log that does not exist. Neither on nor off. |
| Signal could not find out. |
Category | Examples |
|---|---|
Security Log Audit | Process Creation auditing, Logon auditing - the Security log's audit policy only. |
Logging settings | Command lines recorded, PowerShell Script Block Logging, module logging, transcription. |
Log health | The log holding the events can be trusted: size, window, recording. |
Operating system features | Features evidence depends on, such as Prefetch. |
Protection | A security product's protection: while it is off, it detects and records nothing. |
Source health
State | Meaning |
|---|---|
| Read completely. |
| The read ended early (a time limit, a damaged record); what was read is kept. |
| A reader exists, but nothing could be read. |
| The host does not have the source. |
A worked example
A run has no Executions signals. Is the host clean?
-
Check the telemetry
Process Creation auditing:
off. Windows never recorded a process creation. -
Check the rule outcomes
Most EXEC rules over
process_creationarenot_runwithdependency_off. -
Check the other sources
Prefetch, BAM and the PCA list (
program_run) were read: some program runs are still visible, without command lines. -
Conclude correctly
"No process signals, because process creations were not recorded; program runs were checked." Not "nothing ran".
Gaps on a signal
A signal can carry its own gaps: what Signal tried to add and could not. For example, a process's exit time cannot be shown when Process Termination auditing is off. The gap names the item and the reason.