When to rely on Signal

The run was elevated, and LogIntegrity raised no signal

The logs were read whole, auditing was on, and nothing says they were tampered with.

The telemetry of the modules you rely on is on

The evidence their rules need was recorded.

The question is about the host's state now

Services, tasks, auto-starts, applications, extensions, exclusions, remote tools are read whatever the logs say.

A signal names its source record

You can go back to the original record and check it.

Process Creation auditing or command-line logging is off

Your EDR's process history.

The Security log's window is shorter than the incident

-shadow, your SIEM's copy of the logs.

A log was cleared

-shadow, the SIEM, the EDR.

The host runs an antivirus other than Defender

That product's own console.

The question is about the network

Firewall, proxy and DNS logs.

The question is about a domain account

Signal on the domain controllers, and the identity provider's logs.

"Is there an implant in memory?"

Memory is not read.

"Is this file malware?"

File content is not scanned. Signal tells you it is unsigned, where it is, what started it and what VirusTotal said (in the console).

"Is there a rootkit?"

A rootkit hides from Windows' own interfaces, which Signal uses.

"What did the user open and browse?"

User-activity reconstruction (LNK, jump lists, shellbags, full history) is analysis, not a survey.

"What did this account do in the cloud?"

Recorded by the cloud service, not the host.