Haxoris Wiki

EDR And SIEM Coverage Gaps

How EDR And SIEM Coverage Gaps works

EDR and SIEM coverage gaps are the hosts, log sources and event types that produce no usable telemetry for the defender. Three distinct failures sit under one heading: an agent that was never installed on a subnet, appliance or legacy server; a forwarder that once shipped and silently stopped; and events that reach the SIEM but match no correlation rule, so they are stored and never seen. All three read as a healthy, fully green console from the operations desk.

The attacker gains a room with the lights off. Actions on an unmonitored host, or of an event class nobody alerts on, leave evidence only in raw storage that no analyst queries until an incident forces a retro-hunt. It is easy to miss because coverage is assumed from ingest volume - a SIEM taking millions of events per second looks busy while a whole VLAN, a paused Sysmon service or a disabled auditd ruleset contributes nothing, and the gap is invisible unless someone reconciles agents to assets and detonates a test to prove the path fires.

EDR And SIEM Coverage Gaps in practice

Reconcile the agent inventory against the asset list

Coverage is measured against ground truth, so start from the authoritative inventory and subtract what the EDR console knows. Live, in-scope hosts that are missing are the finding.

# Authoritative hosts (from CMDB / DHCP / AD export) vs enrolled agents
sort -u asset_inventory.txt > /tmp/assets.txt
sort -u edr_enrolled_hosts.txt > /tmp/agents.txt

# Hosts present in the estate but absent from EDR
comm -23 /tmp/assets.txt /tmp/agents.txt

# Cross-check reachable-but-unmonitored hosts on a lab segment
nmap -sn 10.10.20.0/24 -oG - | awk '/Up$/{print $2}' | sort -u > /tmp/live.txt
comm -23 /tmp/live.txt /tmp/agents.txt

Detonate a benign canary and confirm the alert

An enrolled agent is not a working detection. Run a harmless, marked test that a correct policy must catch, then look for the alert. Use the standard EICAR test string and a benign encoded-command test - neither is malware.

# AV/EDR file detection: EICAR is a harmless industry test string, not a virus
$eicar = 'X5O!P%@AP[4\PZX54(P^)7CC)7}$' + 'EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+H*'
Set-Content -Path C:\Temp\CANARY-eicar.com -Value $eicar

# Behavioural test: benign base64 command that should trip "encoded PowerShell" rules
$b64 = [Convert]::ToBase64String([Text.Encoding]::Unicode.GetBytes('Write-Output CANARY-4471'))
powershell.exe -EncodedCommand $b64

Record the exact time of each detonation so it can be joined to the alert stream.

Produce a log-source silence report

A source that stopped shipping is the most common gap. List every expected source and flag any that has gone quiet against its own baseline.

Source (host / log)            Last event seen     Baseline EPS    Verdict
-----------------------------  ------------------  --------------  ----------------
DC01 / Security                14s ago             120             OK
FILE02 / Security               3d ago             45              SILENT - forwarder down
APPSRV5 / Sysmon               19d ago             30              SILENT - service stopped
LINUX-BASTION / auditd         41d ago             12              SILENT - ruleset empty
FW-EDGE / traffic              22s ago             800             OK

Reproduce it from the SIEM directly, for example Splunk: | tstats latest(_time) as last by host, sourcetype | eval mins=(now()-last)/60 | where mins>60.

Check Windows, Sysmon and auditd audit policy gaps

Events that were never generated cannot be forwarded. Confirm the host is actually configured to record the categories the detections depend on.

; Minimum Sysmon config coverage to verify is loaded (config, not exhaustive)
; ProcessCreate (1), NetworkConnect (3), ImageLoad (7), CreateRemoteThread (8)
[sysmon-check]
verify = ProcessCreate, NetworkConnect, CreateRemoteThread, RegistryEvent
command = Get-Service Sysmon* ; sysmon.exe -c

; Windows advanced audit policy - expected ENABLED subcategories
Logon = Success,Failure
Process_Creation = Success        ; requires Event ID 4688 + command-line auditing
Object_Access_File_Share = Success,Failure

; Linux auditd - expected rules present in /etc/audit/rules.d/
auditctl_list = auditctl -l | grep -E 'execve|connect'

On Windows run auditpol /get /category:* and confirm 4688 with command-line auditing; empty output for a category is a gap.

How to fix and prevent EDR And SIEM Coverage Gaps

  1. Reconcile agents to the asset inventory on a schedule
    • Automate the comm-style diff weekly and open a ticket for every unmonitored in-scope host.
    • Treat appliances, hypervisors and legacy OSes explicitly; they are the usual agentless survivors.
  2. Alert on log-source silence, not only on events
    • Baseline each source’s events-per-second and page an analyst when it drops to zero; a dead forwarder and a disabled one look the same.
  3. Prove detections with recurring benign detonations
    • Fire EICAR and encoded-command canaries per policy tier and assert the alert lands within an agreed window; a missing alert is a broken rule, not a passed test.
  4. Standardise and monitor audit policy
    • Deploy Sysmon, Windows advanced audit and auditd rulesets by configuration management, and alert when a host drifts from the required subcategories.
  5. Close the collected-but-unalerted gap
    • Map ingested event classes to correlation rules and report the classes with no rule; stored-only telemetry is cost without coverage.

Last updated

References