Detection Engineering and Security Operations
Log Source and Visibility Gap Analysis
We identify which logs are missing from which systems and which attacker behaviors cannot be detected as a result.
What it is
Detecting a behavior requires collecting the log that reveals it. However, log sources can silently stop or new systems may not be included. The analysis compares your asset inventory with the data actually reaching your SIEM. The result shows on MITRE ATT&CK which attacker techniques are not visible.
Scope
- Comparison of asset inventory with systems sending logs to the SIEM
- Review of operating system audit policies and application log settings
- Detection of parsing errors and empty fields
- Verification of timestamp consistency and clock synchronization
- Comparison of retention periods with investigation and regulatory requirements
- Health monitoring recommendations to detect silent log sources
The need
When organizations need it
- When an incident investigation reveals that the required logs were never collected.
- When you are not confident you could quickly determine the scope of a data breach from your logs.
- When a log source has been silent for weeks and no one noticed.
Method
How we work
-
Inventory mapping
We compare your asset inventory with sources that have recently sent logs to the SIEM.
-
Quality control
We check that incoming logs are parsed, fields are populated, and timestamps are consistent.
-
Technique coverage
We map each log source to the ATT&CK techniques it covers and list the techniques that remain unseen. We validate the mapping with sample behaviors.
-
Priority list
We rank missing sources by the visibility gaps they would close and their cost.
Outcome
What you have at the end
You know which logs are missing from which systems and which behaviors are hidden as a result. Missing log sources are ranked by the visibility they would provide.
Frequently asked questions
Our SIEM already collects many logs. Can there still be gaps?
Yes. Log volume does not indicate coverage. Volume may come from a few noisy sources while critical systems are missing.
What access is required for the analysis?
Read access to the SIEM and a copy of your asset inventory are sufficient. No agent is installed on your systems.
Detection Engineering and Security Operations
Other services in this area
Let's talk about this service.
Tell us briefly what you need. We will agree on the scope and timing together in the first meeting.
Schedule a Meeting