Silence a log source and prove you would notice

short · 55 min · Objective 4.1

Task

Stop one source from reporting, confirm nothing alerts on its own, then build the pipeline monitoring that would have caught it.

Steps

  1. Record the baseline: events per hour per source over a period, into lab/ingest-baseline.csv as source,events_per_hour,last_seen.
  2. Stop one source -- block its path, stop the agent, expire its credential. Wait, then confirm that NOTHING in the platform alerted, and record that in lab/silence.md.
  3. Build the four pipeline measures: expected sources against reporting sources, volume against baseline, latency, and parse failure rate. Derive the expected list from lab/cmdb.csv, not from a typed list.
  4. Restore the source, then stop a different one and confirm the new monitoring alerts. Capture the alert in lab/ingest-alert.txt.
  5. Induce a PARTIAL failure -- reduce a source to a fraction of its normal volume rather than to zero -- and confirm the volume measure catches it. Capture it.

Verify

awk -F, 'NR>1 {n++} END {print n" source(s) baselined"}' lab/ingest-baseline.csv
grep -Eci 'nothing alerted|no alert|silent' lab/silence.md
test -s lab/ingest-alert.txt && echo "full failure alerted"
grep -Eci 'partial|reduced|percent|%' lab/ingest-alert.txt lab/silence.md 2>/dev/null

A baseline for every source, a recorded confirmation that the first silence alerted nothing, and alerts captured for BOTH a full and a partial failure. The partial case is the harder one and the more damaging, because a source at 10% of normal still looks alive.

This is an independent study companion for CompTIA SecurityX CAS-005 and is not produced by or endorsed by CompTIA.