<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: performing-log-source-reliability-analysis
description: >-
  Analyze log source reliability through coverage scoring, gap detection,
  latency measurement, schema drift monitoring, and health dashboards to
  ensure detection pipelines have trustworthy telemetry foundations.
domain: cybersecurity
subdomain: security-data-engineering
tags:
  - log-reliability
  - coverage-scoring
  - gap-detection
  - latency
  - schema-drift
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  frameworks: ["NIST 800-92", "CIS Controls v8", "MITRE ATT&CK"]
  tools: ["python3", "duckdb", "prometheus"]
  mitre-attack: ["T1562"]
---

# Performing Log Source Reliability Analysis

## Overview

Detection coverage depends on reliable log sources. A single silent failure —
an agent crash, a firewall rule blocking syslog, a misconfigured forwarder —
can blind detection for days. This skill covers measuring source reliability
through coverage scoring, gap detection, latency tracking, schema drift
monitoring, and building health dashboards.

## Prerequisites

| Requirement | Details |
|---|---|
| Access to log ingestion metadata (event counts, timestamps) | Required |
| Baseline inventory of expected log sources | Required |
| Monitoring infrastructure for alerting on gaps | Required |
| Understanding of detection rule dependencies on sources | Required |

## Key Concepts

- **Coverage score**: Percentage of expected sources actively reporting
- **Gap detection**: Identify sources that stopped sending events
- **Ingestion latency**: Time between event generation and availability
- **Schema drift**: Unexpected field additions, removals, or type changes
- **Detection dependency mapping**: Which rules break when a source goes dark

## Workflow

### Step 1: Build Source Inventory

```python
from dataclasses import dataclass

@dataclass
class LogSource:
    """Expected log source definition."""
    name: str
    source_type: str  # "edr", "firewall", "proxy", "cloud", "identity"
    expected_eps: float  # expected events per second
    freshness_sla_seconds: int  # max acceptable latency
    critical: bool = True  # required for detection coverage
    detection_rules: list[str] | None = None
```

### Step 2: Measure Source Health

```sql
-- Source reliability scorecard
SELECT
    source_type,
    COUNT(DISTINCT DATE_TRUNC('hour', time_dt)) AS active_hours_24h,
    24 AS expected_hours,
    ROUND(COUNT(DISTINCT DATE_TRUNC('hour', time_dt)) / 24.0 * 100, 1) AS uptime_pct,
    MAX(time_dt) AS last_event,
    CURRENT_TIMESTAMP - MAX(time_dt) AS current_gap,
    COUNT(*) / 86400.0 AS avg_eps
FROM security.events
WHERE time_dt >= CURRENT_TIMESTAMP - INTERVAL '24 hours'
GROUP BY source_type
ORDER BY uptime_pct ASC;
```

### Step 3: Detect Schema Drift

```python
def detect_schema_drift(
    current_fields: set[str],
    baseline_fields: set[str],
) -> dict:
    """Detect field additions and removals vs baseline."""
    added = current_fields - baseline_fields
    removed = baseline_fields - current_fields
    return {
        "drift_detected": bool(added or removed),
        "fields_added": sorted(added),
        "fields_removed": sorted(removed),
        "baseline_count": len(baseline_fields),
        "current_count": len(current_fields),
    }
```

### Step 4: Generate Reliability Report

```bash
node agent.js health --window 24h --output reliability.json
node agent.js gaps --threshold 15m --alert
node agent.js drift --source edr_events --baseline baseline.json
```

## Detection

```yaml
title: Log Source Reliability Analysis Detection
id: 826d76b7-36ee-4e3d-be74-c99b984a4336
status: experimental
description: Detects suspicious activity related to performing log source reliability analysis techniques in security data engineering context
logsource:
  category: process_creation
  product: linux
detection:
  selection:
    CommandLine: "*performing*log*"
  condition: selection
level: medium
tags:
  - attack.t1562
  - attack.collection
falsepositives:
  - Data pipeline ETL processes during scheduled batch windows
```


**Detection Opportunities**

| Indicator | Source | Detection Logic |
|---|---|---|
| Log Source Reliability Analysis Detection | linux/process_creation | Sigma rule (medium) |
| ATT&CK Coverage | MITRE ATT&CK | T1562 |

## References

- [MITRE ATT&CK Data Sources](https://attack.mitre.org/datasources/)
- [NIST SP 800-92](https://csrc.nist.gov/publications/detail/sp/800-92/final)
- [CIS Controls v8 — Control 8](https://www.cisecurity.org/controls/audit-log-management)
