GUIDES · OPERATE
Healthchecking the data fabric.
A blind spot rarely announces itself. The cheapest insurance against one is three standing checks — is every stream fresh, is volume where it should be, and are events still being enriched — run on a schedule, alerting on drift.
Catch staleness
A connector that quietly dies takes a whole stream with it. Watch the age of the newest event per stream; anything that stops advancing is a stream that stopped flowing.
SHELLlast event age per stream $ td fabric streams --check staleness STREAM LAST EVENT STATUS identity.signin 3s ago ok endpoint.process 2s ago ok cloud.audit 4m 12s ago STALE <- investigate network.flow 1s ago ok
Watch volume
Staleness catches a dead stream; volume catches a half-dead one. Compare current events-per-second to the learned baseline for the hour and alert on a meaningful drop.
| Signal | Healthy |
|---|---|
| Events/s vs baseline | Within the expected band for the hour-of-week. |
| Sustained drop | A 30%+ dip held for more than a few minutes is a source problem, not a lull. |
| Cliff | An abrupt drop to near-zero is almost always a credential or permission change upstream. |
Enrichment coverage
Detections that lean on enrichments quietly degrade if an enrichment source stops resolving. Track the share of events that carry the fields you depend on.
Falling coverage looks like falling threats. If
ctx.asset.tier stops resolving, every rule scoped to crown-jewel assets goes quiet — and quiet reads like safe. Alert on enrichment coverage, not just event volume.Where to go next
- Custom enrichments — keep coverage healthy.
- Data fabric — the store underneath.