When the alert never arrives: check the chain

Start at the source

Use one controlled action with a marker you can search for. Record the test host, actor, target and clock source. Then check whether the source system created the expected event. If it did not, there is no point tuning the SIEM query yet.

This sounds obvious, but it is an easy step to skip when an alert is the expected deliverable. Endpoint policy, audit settings, application code or a different execution path may mean the event never existed.

Follow the fields, not just the event count

Next, find the same record after collection and again after normalisation. Compare the actor, action, target, result and timestamp. A pipeline can deliver the event while renaming, truncating or dropping the field that gives it meaning.

A known-good record from the same source helps separate a dead sensor or queue from a problem specific to the test event. Keep ingestion delay in the timeline. A detection that appears after the response window may still help investigation, but it did not provide timely coverage.

• Did the source emit the record?
• Did the collector receive it?
• Did the important fields survive parsing?
• Did the analytic select the exact record?
• Did the alert carry enough context for triage?
• Did somebody or something make the expected response decision?

Test the analytic against the record you found

Once the normalised event is visible, run the analytic against that record and time window. Check field names, exclusions, joins and thresholds. A synthetic event injected at this layer can test the rule and alerting path, but it says nothing about collection from the real source.

Use a nearby negative control as well. A rule that fires on the test and ordinary administration has not made a useful distinction. Record both results so tuning does not quietly trade one problem for another.

Fix the first gap, then repeat

The first missing stage is the immediate fault. Everything after it is unknown. Correct one condition there and rerun from that point before changing another layer.

Keep the recovered timestamps and field values as the regression case. They are more valuable than a screenshot of one successful alert because they show what every owner in the chain has to preserve.