An analyst's tstats search on the Authentication data model returns no failed logons for the county DC, but raw WinEventLog:Security events exist. What should the analyst check before blaming the domain controller?
Select an answer to reveal the explanation.
Short Explanation
tstats reads the cliff notes, not the whole book. If acceleration is off, the notes are blank even though the DC is still writing Security events. Do not blame the domain controller until those summaries exist.
Full Explanation
tstats searches data-model acceleration summaries, not raw events. If the Authentication model is not accelerated, results can be empty or stale even when WinEventLog:Security is indexed. The analyst should check acceleration status before concluding the DC is silent. CMS, RFID, and SOAR playbooks do not populate Authentication summaries.