Telemetry Lineage, Integrity, and Attestation

Lineage makes a derived event explainable

An alert shows an actor name, asset owner, normalized action, and risk score. None may exist in the original event. The actor was mapped, the owner enriched from inventory, the action translated, and the score calculated later.

Lineage records the origin and transformation path of data. For telemetry, it connects the producer record to collection, parsing, normalization, enrichment, storage, analytic input, and alert output. It lets a reviewer distinguish source facts from later interpretations.

At minimum, preserve producer and event identity, source schema, collection path, transformation names and versions, times, enrichment sources and reference times, analytic version, and output identity. The goal is not to store every intermediate copy forever; it is to make material meaning changes reproducible.

Integrity is narrower than truth

A cryptographic hash can reveal that bytes changed. A signature can bind a key to data. An attestation can state that a component performed a build or transformation. These mechanisms support integrity and provenance claims under a verification policy.

They do not prove that the sensor observed the whole behavior, that its clock was correct, or that its interpretation was accurate. A faithfully signed incomplete event remains incomplete. A compromised authorized producer can sign harmful output.

State the verified claim precisely: this digest matches the stored record; this trusted key signed it; this attestation names this transformer and input. Keep correctness, completeness, and security assessment as separate questions.

Enrichment needs event-time lineage

Asset ownership, identity risk, geolocation, classification, and threat context change. If a historical event is enriched with today’s state without a label, investigators can attribute old activity to the wrong owner or apply intelligence that did not exist at the time.

Record enrichment source, version, retrieval time, effective time, confidence, and whether the value reflects event-time or current state. Keep the original identifier that was looked up. When an enrichment is corrected, decide whether historical results are recalculated or remain tied to the previous version.

Stale enrichment can be more dangerous than missing enrichment because it appears complete. Health should include age, match rate, ambiguity, and population coverage.

Use lineage to find the first broken assumption

When an expected alert is absent, follow the path from producer forward. Did the source create the event? Did collection retrieve it? Did parsing preserve the operation? Did normalization map the actor correctly? Was enrichment available? Did the analytic execute and deliver?

Lineage narrows the failure domain. It also shows blast radius: a parser version or enrichment service may affect many detections. This is why security telemetry data contracts and lineage belong together. The contract states the promise; lineage shows which implementation fulfilled it.

Do not repair the last query until the first divergence is known. Tuning logic around missing or corrupted evidence can make a test pass while weakening the detection claim.

Carry provenance into the alert without overwhelming the reader

The consumer does not need an infrastructure dump, but they need enough to verify consequential fields. Include source links or identifiers, event and ingest time, mapping and analytic version, material enrichments with freshness, dependency health, and known transformations.

For audit and incident preservation, retain the full lineage record under appropriate access controls. Sensitive raw telemetry may require restricted retrieval rather than duplication into every case.

A trustworthy result says: these facts came from these observation points; these fields were derived through these versions; integrity checks produced these outcomes; and these gaps remain. Lineage converts “the platform says so” into evidence another person can challenge.