A county IR lead hunts a wastewater-plant login from two minutes ago. A tstats search on the accelerated Authentication data model is empty, but raw WinEventLog:Security shows the event. What should the analyst conclude?
Select an answer to reveal the explanation.
Short Explanation
Accelerated models are a highlight reel, not a live camera. The login can already sit in the raw index while tstats waits for the next summary pass. During live IR, peek at the raw events before assuming the login never happened.
Full Explanation
Data-model acceleration writes scheduled summaries that tstats reads for speed. Events that arrived after the last acceleration cycle can be invisible to tstats while still searchable in the raw index. During live incident response, treat an empty tstats result as a possible freshness gap and confirm with a time-bounded raw search. Acceleration is a performance trade-off, not proof that Windows events cannot live in Authentication.