Sysmon/ETW Telemetry Stream Interruption Investigation (Log Gap)
When a Sysmon EID stream from an endpoint is interrupted for N minutes (log gap alert), determines the cause of the interruption — tamper, infrastructure failure, or system shutdown — and restores telemetry.
Prepare
5 steps- Calibrate the log gap alert (DR-6-style)
In SIEM, generate an alert tracking the last EID 1 timestamp per endpoint and triggering for gaps exceeding the threshold; set `expectedInterval` based on the environment P95 baseline — too short a threshold produces noise, too long causes late detection
- Identify endpoint heartbeat source
Configure a non-Sysmon "system is up" signal such as EDR agent heartbeat, RDP reachability, or SIEM agent heartbeat; this is essential for distinguishing system-down vs. tamper
- Monitor WEF/WEC or log forwarding agent health metrics
Set up a separate alert that detects forwarding infrastructure outages independently of the Sysmon log gap; this prevents false-positive escalation
- Define escalation chain
SOC L1 → L2/IR → Endpoint/Sysadmin; if the issue is only a log forwarding problem, L1 can resolve it with the operations team — if tamper is suspected, L2/IR approval is mandatory
- Decision gate: is this the right playbook?
If an EID 4 alert arrived simultaneously, switch to the Telemetry Tamper Response playbook; if only the log gap alert triggered, continue with this playbook