When an endpoint event is missing from a central search, the evidence question is where it should have entered the collection path. That path includes event generation, source retention, subscription selection, transport, collector storage, downstream ingestion, and the analyst's query. A missing search result cannot identify which stage failed.
Describe the subscription that actually applied
Microsoft’s Windows Event Forwarding guidance describes forwarding selected endpoint events to a Windows Event Collector and distinguishes baseline and suspect collection. Record the subscription definition, participating devices, channel and event filters, delivery configuration, relevant policy, and change history. Capture the Windows builds and collector software. Applicability in the current source includes named Windows client and server versions; do not assume an example subscription was deployed unchanged.
A subscription can be functioning while omitting the specific event at issue. Collection may also begin after the suspected activity. Record the earliest supported enrollment time rather than treating the collector's general operating period as proof of coverage for every endpoint.
Preserve each stage's evidence separately
Where authorized and available, retain the endpoint's native channel files, collector output, subscription status and diagnostic records, and downstream export. Note the evidence identifier for each. Compare original event time to collector receipt or indexing time without silently replacing one with another. A later ingestion timestamp may describe delayed arrival; it is not a correction to the source clock.
Record the exact central query, time-zone setting, account permissions, pagination, and export limits. Search interfaces can apply defaults that are invisible in a screenshot. Preserve raw identifiers and XML fields where available so duplicate renderings and field normalization can be assessed.
Use an event pair to locate the boundary
- Choose a known relevant source event inside the period, preserving its original channel, provider, host, timestamp, and record identifier.
- Determine whether the applicable subscription selected that event type and host at that time.
- Search the collector's retained records, then the downstream platform, preserving every search boundary.
- Compare nearby known events from the same host and events from other enrolled hosts.
- Record the earliest stage at which the expected record becomes unavailable, without assigning an untested cause.
This comparison can distinguish a broad downstream visibility problem from a host-specific coverage question. It does not reconstruct an event that was never generated or no longer survives. If no suitable known event exists, state that the collection-path test remains incomplete.
Ordinary alternatives and stronger findings
Routine explanations include a device being offline, subscription changes, source rollover, collector maintenance, query permissions, and ingestion delays. These are possibilities to investigate against status records and timing. An endpoint-only gap does not prove a network fault, and a central-only gap does not prove log clearing.
A stronger report describes the tested path and observed boundary: “The native event was present locally and matched the preserved subscription filter, but was not located in the retained collector export.” Any further explanation needs its own evidence. An Event 1102 record, if present, supports a separate clearing observation and should be evaluated under the Security log clear guide.