You’re Only Logging 30% of What Matters: The Telemetry Gap That Blinds Your SOC

Most organizations do not have a detection problem first.

They have a telemetry problem.

If the log never reaches the SIEM, no detection rule, analyst, or AI model can find the attacker in it. That is the hard boundary every SOC runs into. Detection is limited by visibility. No exceptions.

Many organizations collect a basic set of logs—Windows event logs, a firewall feed, maybe a few server alerts—and assume they are covered. They are not. Modern attack paths move through cloud administration planes, SaaS applications, identity providers, remote access systems, DNS, and endpoint telemetry. If those sources are missing, your SOC is working from a partial crime scene.

YOU CANNOT DETECT WHAT YOU DO NOT COLLECT.

THE TELEMETRY GAP THAT BLINDS SECURITY TEAMS

Attackers do not need malware on disk to create risk.

An attacker using valid credentials may never trip traditional antivirus. They may log into Microsoft 365, create mailbox forwarding rules, access SharePoint data, pivot through VPN, enumerate cloud resources, or abuse admin roles in Entra ID or AWS. That activity often leaves identity and audit-log traces—but only if those traces are enabled, retained, and forwarded to the SIEM.

This is why the telemetry gap is so dangerous. Organizations often invest in alerting logic before they invest in complete data coverage. That is backwards.

A mature SOC starts with one question:

Which attack paths can we actually observe from end to end?

If the answer is “only the parts that happen on Windows servers and perimeter firewalls,” then your coverage is incomplete by design.

THE MOST COMMON LOGGING BLIND SPOTS — AND WHY THEY MATTER

1. CLOUD CONTROL PLANE LOGS

Cloud attacks frequently begin with administrative actions, not malware.

If you are not collecting and reviewing AWS CloudTrail, Azure Activity Log, and Microsoft 365 audit logs / Unified Audit Log, you can miss:

New admin role assignments
Disabled security controls
Suspicious mailbox access
New forwarding rules
Application consent abuse
Resource creation or deletion
Snapshot creation and exfiltration staging
Changes to logging, retention, or monitoring settings

These logs matter because attackers who gain privileged access often modify the environment itself. They create persistence, reduce visibility, and access sensitive data through legitimate administrative workflows.

If your SIEM never receives those records, your SOC cannot reconstruct the sequence.

2. IDENTITY PROVIDER LOGS

Identity is the attack surface now.

Entra ID sign-in logs, risk detections, impossible travel indicators, MFA outcomes, and conditional access results are often the only evidence that a valid-account compromise occurred. When an attacker logs in with stolen credentials, there may be no exploit, no malware, and no obvious endpoint artifact.

What you may still see:

Sign-ins from unfamiliar geographies
Impossible travel patterns
Legacy authentication attempts
MFA fatigue or repeated challenge activity
Conditional access failures
Token abuse indicators
Privilege escalation tied to a specific identity

This is exactly why identity telemetry belongs in the SIEM—not buried in a separate admin portal nobody checks during an incident.

3. DNS QUERY LOGS

DNS is one of the most underrated detection sources in the stack.

DNS query logs can reveal:

Command-and-control beaconing
Access to newly registered or low-reputation domains
Malware staging and payload retrieval
DNS tunneling behavior
SaaS abuse and shadow IT usage
Internal hosts repeatedly resolving suspicious infrastructure

Even when other telemetry is thin, DNS often shows where systems are trying to go. That makes it valuable for both early detection and scope analysis.

4. EDR ENDPOINT TELEMETRY

Windows event logs alone are not endpoint visibility.

You need EDR endpoint telemetry that captures process execution, command lines, parent-child process relationships, script interpreter abuse, persistence creation, suspicious network connections, and response actions. Without it, you may know a user logged on—but not what actually executed next.

This blind spot matters against:

Living-off-the-land abuse
PowerShell or script-based activity
Credential dumping
Ransomware pre-encryption behavior
Lateral movement tools
Suspicious child processes from Office or browsers

When attackers avoid malware and use built-in tools, EDR telemetry becomes essential.

5. VPN AND REMOTE ACCESS LOGS

Remote access remains a common entry point.

VPN concentrators, remote desktop gateways, ZTNA platforms, and other remote access tools generate logs that show who connected, from where, when, and with what outcome. Missing this source means missing:

Suspicious after-hours access
Access from unusual countries or ASNs
Repeated failed authentication attempts
Simultaneous sessions from different regions
Access from unmanaged devices
Connections preceding privileged activity or data theft

Many investigations depend on correlating remote access events with identity, endpoint, and cloud activity. Without those logs, timelines break.

6. SAAS APPLICATION AUDIT LOGS

Critical business data no longer lives only on file servers.

Organizations now depend on platforms such as Microsoft 365, Google Workspace, Salesforce, HR systems, ticketing tools, collaboration platforms, and line-of-business SaaS applications. Their audit logs can expose:

Bulk downloads
Privilege changes
File sharing to external parties
Rule creation and automation abuse
API token misuse
Account changes tied to insider risk or compromised credentials

Attackers increasingly target SaaS because the data is already organized, accessible, and valuable. If the application has an audit trail and you are not ingesting it, you are choosing blindness.

7. PASSWORD VAULT AND PRIVILEGED ACCESS MANAGEMENT LOGS

Privilege use should never be invisible.

Password vaults and privileged access management (PAM) platforms record checkout activity, session launches, credential rotations, approval events, and privileged access history. These logs are critical for detecting:

Unauthorized privileged credential use
Shared admin account abuse
Emergency account activation
Unapproved vault access
Privilege escalation followed by lateral movement
Admin sessions tied to high-risk changes

When a domain admin account, cloud admin role, or service credential is abused, vault and PAM records may be the only defensible proof of who accessed what and when.

WHY VALID-CREDENTIAL ATTACKS EXPOSE WEAK TELEMETRY FAST

Security teams still over-index on malware-centric detection.

But many modern intrusions start with stolen credentials, session theft, password spraying, consent phishing, or MFA fatigue. In those cases, the attacker may appear to be a legitimate user. They log in normally. They use real applications. They access data through approved channels.

That means the best evidence often sits in:

Identity provider sign-in logs
Conditional access results
Microsoft 365 Unified Audit Log
Cloud administrative logs
VPN logs
SaaS audit records
PAM and vault session history
EDR process and user-behavior telemetry

Miss those sources and your SOC may see nothing more than “user successfully authenticated.” That is not an investigation. That is guesswork.

ATTACKERS USING VALID CREDENTIALS LEAVE AUDIT TRAILS—IF YOU ARE COLLECTING THEM.

RETENTION: WHY 30 TO 90 DAYS IS NOT A DEFENSIBLE STRATEGY

Collection without retention is only partial coverage.

Many SIEM deployments keep hot searchable data for 30 to 90 days because that is the default economics of log storage. That may be enough for noisy malware discovered immediately. It is not enough for delayed-discovery incidents, insider misuse, business email compromise, or slow-moving cloud abuse.

For HIPAA-regulated organizations, the documentation requirement under 45 CFR 164.316 requires policies, procedures, actions, activities, and assessments required by the Security Rule to be retained for six years from the date of creation or when last in effect, whichever is later. That does not mean every raw log must sit in expensive hot storage for six years. It does mean your retention strategy must support defensible investigation, audit response, and evidence preservation over time.

If you discover an incident six months later and the relevant cloud, identity, VPN, or audit logs are gone, you may not be able to determine:

Whether ePHI or sensitive data was accessed
Which accounts were used
How long the attacker persisted
Which systems were touched
Whether safeguards actually worked
Whether your investigation findings are defensible

Late-discovered incidents are common. Retention has to reflect that reality.

HOT, WARM, AND COLD TIERING — WHAT IT ACTUALLY MEANS

A practical telemetry strategy separates storage by investigation value and cost:

Hot storage: Immediately searchable data for active detection, triage, and rapid investigations
Warm storage: Less expensive but still reasonably accessible data for historical analysis and extended investigations
Cold storage: Low-cost archival retention for compliance evidence, long-tail investigations, and legal or audit needs

A defensible model for many regulated organizations looks like this:

Hot: 90 to 180 days for high-value security telemetry
Warm: 6 to 12 months for broader investigative access
Cold: 1 to 6+ years based on compliance, contractual, insurance, legal, and risk requirements

The exact answer depends on your environment and obligations. But 30 days hot and nothing else is rarely defensible. Neither is keeping only firewall and Windows logs while discarding cloud and identity evidence.

Retention policy should be based on:

Regulatory requirements
Incident discovery timelines
Threat model and likely attack paths
Insurance expectations
Legal and eDiscovery needs
Cost-optimized tiering—not blind deletion

A PRACTICAL TELEMETRY COVERAGE CHECKLIST

Use this checklist to pressure-test whether your SOC can actually observe the attack paths you care about.

IDENTITY AND ACCESS

Entra ID sign-in logs — catches suspicious sign-ins, impossible travel, MFA abuse, token misuse indicators
Conditional access results — catches blocked or failed policy enforcement, risky sessions, legacy authentication attempts
Identity provider audit logs — catches role changes, app consent abuse, MFA resets, directory modifications
VPN / remote access logs — catches anomalous remote access, brute force activity, unmanaged device access, session correlation gaps
PAM / password vault logs — catches privileged credential checkout, emergency access, admin session abuse

CLOUD AND SAAS

AWS CloudTrail — catches IAM changes, API misuse, persistence creation, logging tampering, destructive admin actions
Azure Activity Log — catches subscription and resource changes, policy modifications, deleted or newly created assets
Microsoft 365 Unified Audit Log — catches mailbox access, forwarding rules, file access, admin actions, eDiscovery and sharing events
SaaS application audit logs — catches bulk exports, permission changes, external sharing, API token abuse

ENDPOINT AND NETWORK

EDR endpoint telemetry — catches process execution, scripting abuse, credential dumping, persistence, lateral movement
Windows event logs — catches authentication events, service changes, policy changes, basic host activity
Firewall logs — catches allowed and denied traffic patterns, egress anomalies, segmentation violations
DNS query logs — catches C2 lookups, suspicious domains, tunneling, malware staging infrastructure
Proxy or web gateway logs — catches malicious browsing, download activity, data exfiltration paths

SECURITY OPERATIONS AND EVIDENCE

SIEM ingestion health logs — catches broken collectors, parsing failures, silent source outages
SOAR case and response logs — catches what actions were taken, when, and by whom
Time synchronization and integrity controls — preserves reliable timelines across sources
Retention and archive validation — catches the very real problem of “we thought we had the logs”

If a source is critical to an attack path but is not enabled, not forwarded, not normalized, or not retained, count it as a gap.

WHAT DEFENSIBLE COVERAGE LOOKS LIKE

The goal is not to ingest everything forever.

The goal is to ingest the right telemetry, correlate it across identity, endpoint, network, cloud, and SaaS layers, and retain it long enough to support detection, response, audits, and late discovery. That requires engineering discipline—not checkbox logging.

At Cenova Cyber, we help organizations close these coverage gaps with 24/7 security monitoring, a managed SOC, and a SIEM/SOAR stack with Wazuh designed for practical detection and compliance. Our monitoring programs support organizations that need visibility aligned to HIPAA, NIST 800-171, and CMMC Level 2 requirements—without forcing your internal team to build and run a SOC alone.

Our approach focuses on:

Prioritizing high-value telemetry sources first
Ingesting and correlating cloud, identity, endpoint, and network logs
Monitoring around the clock with analyst oversight
Preserving audit-ready evidence for regulated environments
Supporting continuous monitoring for HIPAA, NIST 800-171, and CMMC Level 2 obligations
Reducing blind spots before attackers exploit them

Learn more about Cenova Cyber’s Security Monitoring and Managed Cybersecurity services.

CLOSE THE TELEMETRY GAP BEFORE IT BECOMES AN INCIDENT

If your organization is only logging Windows event logs and firewall traffic, your SOC is operating with partial vision.

That is not a tooling problem. It is a coverage problem.

Contact Cenova Cyber today for a telemetry coverage review. We will help you identify missing log sources, validate retention strategy, and build 24/7 monitoring that gives your team the visibility to detect real attack paths—before those blind spots turn into reportable incidents.