A server absent from a log search may have stopped reporting, or the search may still be running. The team needs to know which before opening a remediation ticket.
Start with the asset record. Check the source for each control, then hand confirmed gaps to the team responsible for the asset.
01
Compare coverage
Match assets against endpoint protection, backup, logging and vulnerability evidence.
02
Check the search result
Retrieve the log search status alongside the matching events so a pending search can be distinguished from an empty result.
03
Keep one task per team
Group confirmed gaps by owner and update the team’s existing remediation task as its asset list changes.
Choose a service, its evidence sources and the team that owns remediation. Walk one asset through the review before expanding the scope.
Talk to an expert
