A county IR lead hunts a wastewater-plant login from two minutes ago. A tstats search on the accelerated Authentication data model is empty, but raw WinEventLog:Security shows the event. What should the analyst conclude?
Select an answer to reveal the explanation.
Short Explanation
Accelerated models are a highlight reel, not a live camera. The login can already sit in the raw index while tstats waits for the next summary pass. During live IR, peek at the raw events before assuming the login never happened.
Full Explanation
When a county IR lead hunts a wastewater-plant login from two minutes ago, an empty tstats result on the accelerated Authentication data model does not prove the logon never happened if raw WinEventLog:Security already shows it. Data-model acceleration is scheduled summarization; brand-new events may be invisible to tstats until the next acceleration cycle while remaining fully searchable in the raw index. During live incident response, treat empty accelerated results as a possible freshness gap and confirm with a time-bounded raw search. Acceleration is a performance trade-off, not absolute truth about event existence.
Claiming the Authentication data model cannot store Windows security events fails by concept: Windows security is a primary Authentication feed once CIM-mapped. Claiming the license master silently dropped the last two minutes invents a licensing failure when the raw events are present. Claiming tstats works only after the notable is closed confuses hunt search mechanics with notable workflow state.
Exam caveat: SPLK-5001 IR freshness items contrast tstats on accelerated models with raw index visibility—empty tstats plus present raw events means acceleration lag, not missing telemetry.
Operational check: reproduce the hunt with a raw WinEventLog:Security search for the wastewater plant window, note the acceleration schedule or last summary time, and rely on raw confirmation for minute-old IR while using tstats for broader historical sweeps after summaries catch up.