The library consortium's Enterprise Security Web domain dashboard is empty, while the Access domain shows staff logons. What is the most likely data-source assessment?
Select an answer to reveal the explanation.
Short Explanation
One full dashboard and one empty dashboard is a coverage X-ray. Access is getting identity logs; Web is not getting a mapped proxy feed. That is a data or CIM gap, not a law of library science.
Full Explanation
If the library consortium's Enterprise Security Web domain dashboard is empty while the Access domain shows staff logons, the most likely data-source assessment is that the proxy or web sourcetype is missing or not CIM-mapped, even though identity data is landing. Access having data proves Authentication onboarding works; Web emptiness isolates a proxy or web mapping gap rather than a total Enterprise Security outage across the consortium.
Blaming search-head CPU that empties only the Web dashboard is an unlikely selective failure when Access still renders successfully for staff logons. Claiming library patrons never generate Web events so the dashboard must stay empty ignores staff and patron browsing that proxies and secure web gateways typically log. Claiming Enterprise Security hides the Web domain until a ransomware notable fires invents a gating rule that does not exist in the product.
Exam caveat: one Security Domain full and another empty points to a per-domain data-source or CIM gap, not global ES failure.
Operational check: inventory proxy or web gateway sourcetypes for the library consortium, apply Web CIM tagging via the supported technical add-on, verify sample urls populate, and refresh the Web domain dashboard.