Could the relevant event type have been filtered out?¶

Yes. A relevant event type can be filtered out at the source, collector, SIEM, dashboard or export stage.

The event may therefore exist somewhere even though it is absent from the material received.

Avoid the dangerous assumption¶

The dangerous assumption is that a search result or export contains every event generated by the system.

It may contain only the events allowed through several filters.

Source systems can be configured to record selected categories, severities, users or actions. Collectors may forward only approved event types. SIEM connectors may drop low-priority data or exclude records to control cost.

A dashboard query can also hide records through time ranges, search terms, exclusions or saved views. An export may include only visible columns or the first set of results.

Investigators should identify each stage between event creation and the file or screen examined. Ask what source filters, collection policies, connector settings, queries and export options applied.

Check whether the event type has a different name, code or category. A search for “login” may miss token validation, session refresh or single sign-on events stored under another label.

Preserve query text, filter settings, result counts and screenshots where useful. Request a broader or native export if proportionate.

A filtered-out event is not the same as a deleted event. The source record may remain available and recoverable from another system or archive.

Operational takeaway¶

Relevant events can be excluded at several stages, so investigators should examine source, collection, dashboard and export filters before treating their absence as proof that no record exists.