Agent Foskett Investigation • Microsoft Sentinel • Windows Security Events • Data Connectors • KQL
Nothing Was Detected — Because Nobody Was Collecting the Log
The SOC searched the logs.
No suspicious sign-in.
No process-creation event.
No useful Windows Security Event from the server.
The first conclusion was tempting:
Nothing happened.
Agent Foskett asked a more important question.
Was anybody actually collecting the evidence we expected to find?
No Results Is Not the Same as No Activity
An empty query can mean the activity did not happen. It can also mean the telemetry never reached the workspace.
✓ Verify the source is collecting
✓ Verify the expected table
✓ Verify the collection scope
The query returned nothing
The investigation began after suspicious activity was reported on a Windows server named DC-02. The SOC expected Microsoft Sentinel to contain Windows Security Events that could help reconstruct authentication, process and group-membership activity. The initial KQL returned no useful records from the server. That result looked reassuring only if one assumption was true: that the events were being collected in the first place.
No recordsThe expected Windows Security Events were absent from the query results.
No detectionNo analytics rule had raised an incident around the activity.
One dangerous assumptionThe team initially treated missing telemetry as evidence that nothing occurred.
Start by proving which computers are actually sending SecurityEvent data
Before hunting for one Event ID, establish whether the expected source is represented in the table at all. If peer servers are sending thousands of events while the target server is absent, the investigation has moved from threat hunting into telemetry validation.
- 1
- 2
- 3
- 4
- 5
- 6
- 7
- 8
SecurityEvent
| where TimeGenerated > ago(7d)
| summarize Events=count(),
FirstSeen=min(TimeGenerated),
LastSeen=max(TimeGenerated)
by Computer
| order by Events descLook specifically for the missing server
Search the expected
SecurityEvent table for the target system. A completely empty result from the target host should trigger a collection check before any security conclusion is made.- 1
- 2
- 3
- 4
- 5
- 6
- 7
- 8
- 9
SecurityEvent
| where TimeGenerated > ago(7d)
| where Computer =~ "DC-02"
| summarize Events=count(),
FirstSeen=min(TimeGenerated),
LastSeen=max(TimeGenerated)
by EventID
| order by Events descThen check whether the data is landing in WindowsEvent instead
A missing result in one table does not always mean the event was never ingested. Windows Forwarded Events are written to
WindowsEvent, so Agent Foskett checks that table before declaring the telemetry absent. The distinction matters because an analytics rule querying SecurityEvent will not automatically detect records that only exist in WindowsEvent.- 1
- 2
- 3
- 4
- 5
- 6
- 7
- 8
- 9
WindowsEvent
| where TimeGenerated > ago(7d)
| where Computer =~ "DC-02"
| summarize Events=count(),
FirstSeen=min(TimeGenerated),
LastSeen=max(TimeGenerated)
by EventID
| order by Events descCompare the events you expected across the environment
Once the expected table is known, compare representative security events across systems. The exact Event IDs required will depend on the investigation and collection policy, but the pattern is useful: establish whether peer systems produce the evidence while the target source does not.
- 1
- 2
- 3
- 4
- 5
- 6
SecurityEvent | where TimeGenerated > ago(7d) | where EventID in (4624, 4688, 4728, 4732) | summarize Events=count() by Computer, EventID | order by Computer asc, EventID asc
The missing alert finally made sense
The investigation found that DC-02 was not within the effective Windows Security Event collection scope. Sentinel could not alert on records it never received. The empty query was therefore not evidence that the suspicious activity had not occurred. It was evidence of a visibility gap.
Investigation principle: before interpreting an empty query, prove the telemetry exists.
What Agent Foskett checked
Source coverageWas the affected computer represented in the expected Sentinel table?
Correct tableWas the data expected in SecurityEvent, WindowsEvent or another table?
Collection scopeDid the connector and its collection configuration actually include the target machine?
Event coverageWere the required Windows Security Events included in the collection configuration?
Peer comparisonWere equivalent systems producing the records that DC-02 was missing?
Detection dependencyDid the analytics rule depend on a table or Event ID that was absent?
What the evidence can and cannot prove
A gap in the expected Sentinel table can prove that the workspace did not contain the records required for that investigation during the period reviewed. It does not, by itself, prove exactly why collection failed. Confirm the connector, data collection configuration, source health, scope and any filtering before assigning the root cause.
ProvenThe expected security telemetry was not available in the table used by the investigation.
Requires validationWhether the cause was connector scope, data collection configuration, forwarding design or another ingestion issue.
Do not assumeAn empty query does not prove an event did not occur.
Related investigations
I Opened The New Defender Portal… Now What?Understand why empty dashboards can point to incomplete investigation visibility after onboarding.Nothing Flagged The PowerShell DownloadSee the difference between telemetry that exists without an alert and telemetry that was never collected.The Defender Exclusion Was Added 12 Minutes Before the Malware RanInvestigate why an expected security control did not produce the result defenders assumed it would.
Final thought
Security teams spend a lot of time asking what the logs say. Sometimes the more important question is whether the logs ever arrived.
An empty result can feel reassuring. It can also be the most dangerous result in the investigation if nobody first verifies the data source behind it.
You cannot detect what you never collect.
And this time, the logs didn't already know — because nobody had invited them to the investigation. 😂🔎
An empty result can feel reassuring. It can also be the most dangerous result in the investigation if nobody first verifies the data source behind it.
You cannot detect what you never collect.
And this time, the logs didn't already know — because nobody had invited them to the investigation. 😂🔎
