A visual brief using illustrative data to show where cloud telemetry can disappear between a provider service and an analyst query.
At a glance
Key findings
- Configuration presence does not prove searchable delivery.
- Collection gaps compound across routing, transformation, and indexing.
- A small set of canary events can test the entire evidence path.
Test the evidence path
A logging control is not complete when a service checkbox is enabled. It is complete when a known event can be generated, routed, retained, transformed, indexed, and found with the query an analyst will actually use.
The demonstration data below intentionally uses fictional values. Its purpose is to show how a delivery test makes silent loss visible.
Illustrative event delivery by stage
The synthetic dataset loses 18 percentage points between event creation and searchable evidence.
Bars decline from 100 percent generated to 97 percent routed, 91 percent transformed, and 82 percent searchable.
Interactive chart loads as it approaches the viewport.
View accessible data table
| Category | Events retained |
|---|---|
| Generated | 100% |
| Routed | 97% |
| Transformed | 91% |
| Searchable | 82% |
Source Cloud Security Desk demonstration dataset
Method Fictional rates for 1,000 generated canary events. The figures illustrate an assurance method and are not provider benchmarks.
Download source data (CSV) ↓Latency is part of coverage
Evidence that arrives after an investigation window is operationally absent. Teams should define a time-to-search objective for high-value sources and test both typical and tail latency.
Illustrative time to searchable evidence
The example’s slowest pipeline is four times slower than its intended objective.
Grouped values show median and 95th-percentile search latency: pipeline A 3 and 8 minutes, B 5 and 19 minutes, C 7 and 32 minutes.
Interactive chart loads as it approaches the viewport.
View accessible data table
| Category | Median | 95th percentile |
|---|---|---|
| Pipeline A | 3 min | 8 min |
| Pipeline B | 5 min | 19 min |
| Pipeline C | 7 min | 32 min |
Source Cloud Security Desk demonstration dataset
Method Synthetic median and 95th-percentile latencies for three unnamed collection pipelines. Values are illustrative only.
Download source data (CSV) ↓The minimum proof set
Keep the original event identifier, timestamps at each pipeline stage, the final query, the returned record, and any transformation rule that touched it. Repeat after routing or schema changes.