Monitor the monitoring path

Silence is meaningful only when the observation path is working.

Define expected observations

Telemetry health is evidence that expected observations are produced, delivered, and interpreted within defined limits. A heartbeat is a scheduled status signal; it helps assess collection continuity even when no security alert should occur. It does not prove every security event type is collected correctly.

Assume three fictional sources each produce one heartbeat per minute. The review covers exactly ten minutes, 12:01 through 12:10 inclusive. All thirty signals should have reached the central dashboard by 12:12 under the agreed two-minute delivery allowance.

Supplied pipeline record

• H1: By 12:12, A and B each have ten usable heartbeats centrally; every signal arrived within two minutes of generation.
• H2: C has zero centrally. Its local status record says ten were generated and are still waiting for delivery.
• H3: The central security dashboard displays zero alerts for all three sources.

Count what is actually known

Twenty of thirty expected heartbeats arrived: about 66.7% for this interval. C’s local production record argues against assuming the source was simply inactive. It does not locate the precise delivery failure or establish that central parsing would succeed once data arrives.

Mark C’s central coverage as degraded and assign its collection-path investigation. Preserve the expected interval, delivery allowance, and local queue observation. Later arrival can improve completeness while still missing the freshness requirement.

H3 cannot distinguish low suspicious activity from lost observations. Even A and B’s healthy heartbeat delivery leaves the accuracy and coverage of their security-event rules as separate questions.

Model conclusion: Central heartbeat coverage is incomplete; zero alerts does not support an all-clear for C.