Log source health
Log source health is whether each log source is sending data on time and in the expected shape. When a source drops, every rule that reads it goes quiet. Tying source health to the rules that depend on it is what turns a data alert into a detection alert.
What Log source health means here
The basic check is volume or last-seen time per source. The better check maps each source to the rules affected.
Most products monitor sources and rules in separate places.
Example of Log source health in Panther documentation
Panther's Monitoring Log Sources page shows unhealthy sources and drop-off alarms, but it is not linked to the rules that use those sources. docs.panther.com read 2026-11-03
Terms related to Log source health
- Silent rule: A silent rule is a detection that stops producing alerts because it is failing, disabled or starved of data, not because there is nothing to find.
- Data source coverage: Data source coverage is which log sources are onboarded, and whether the rules that need them can run.
- Schema change: A schema change is an edit to how log fields are named, typed or nested, whether in the source system, the parser or the normalisation layer.
The matrix scores platforms on whether they document these ideas: see the matrix and the full glossary.