Troubleshooting Activity Import Connector Collection Issues: When Successful Runs Miss Expected Events

Audience: Securonix Administrators, Data Onboarding Teams, SOC Engineers, and MSSPs 

Product Module: Add Data → Activity / Activity Import Connectors 

Tags: Activity Import Connector, Data Collection, Missing Events, Collection Window, Connector Checkpoint, Data Onboarding 

Overview 

An Activity Import Connector can complete successfully and still fail to collect the specific events you expect. This usually means the connector can authenticate and connect to the source, but the expected events fall outside the collection scope, time window, source API permissions, or result set being retrieved. 

This guide focuses on that scenario: a successful connector run with missing or incomplete Activity Data. 

When to use this guide 

Use this guide when: 

Quick diagnosis: trace one known source event 

Choose one event that is visible in the source platform but missing from Securonix.

Record: 

Then navigate to Menu → Add Data → Activity and open the affected connector. 

Step 1 – Determine whether the connector has reached the event time 

1. In Menu → Add Data → Activity, open the affected connector. 
2. Record the connector’s Last Event Time. 
3. Compare it with the timestamp of the known source event. 
4. Use the same time zone for both values before deciding whether the connector has reached the event. 

Step 2 – Validate the source data type and collection scope 

A successful connector run retrieves only the data types and source records that the connector is configured and permitted to collect. 

1. In the source platform, open the known missing event. 
2. Record its log category, event type, API resource, and any tenant, workspace, subscription, or account context required by that source. 
3. In Menu → Add Data → Activity, open the connector. 
4. Compare the event details with the connector’s documented source type, collection options, and configured account or scope. 
5. If the source event belongs to a data type that is not included by the connector, configure the appropriate supported connector or collection option. 

Step 3 – Check incremental collection behavior 

Many connectors collect new data incrementally after their initial successful run. Depending on the connector, the next request may begin from a saved checkpoint, cursor, watermark, or documented collection window. 

1. Open the connector documentation for the specific source. 
2. Identify whether the connector supports historical collection, an initial lookback period, a checkpoint, or a reset procedure. 
3. Compare the earliest missing event with the period the connector is documented to retrieve. 
4. If the event predates the supported initial collection range, use the documented backfill or historical-collection method if one is available. 

Step 4 – Confirm that source permissions include the missing data 

A source account may be able to authenticate successfully but lack permission to retrieve a particular log category, account, subscription, project, or tenant. 

1. In the source platform, identify the account or service principal used by the connector. 
2. Compare its assigned permissions with the source platform’s requirements for the missing event category. 
3. Confirm that the account can access the same tenant, workspace, subscription, project, or API resource where the known event exists. 
4. If the required permission is missing, have the source-platform administrator grant the documented read access. 
5. Monitor the next scheduled connector run. 

Step 5 – Separate collection delay from a collection gap 

A successful collection job, ingestion, and search availability may occur at different times. 

1. After a successful connector run, wait for the normal processing interval used in your environment. 
2. Open Menu → Operations Center → Activity Monitor. 
3. Filter to the affected data source and the period of the successful run. 
4. Confirm whether Activity Monitor shows ingestion for the data source. 
5. In Spotter, search the same expanded time period using the affected data source. 

Step 6 – Look for incomplete retrieval 

A connector can collect some records while missing others because of source-side API limits, pagination, rate limits, or a response that exceeds the connector’s documented collection behavior. 

1. In the source platform, determine whether the known event appears with other events from the same time period. 
2. Compare the approximate volume of source events with the number of events visible in Securonix for that period. 
3. In Menu → Operations Center → Job Monitor, open the successful connector job and look for warnings, partial-success messages, throttling messages, or API response-limit information. 
4. If the job indicates a rate limit, partial result, or pagination issue, capture the message and connector run time. 

Common scenarios 

Before opening a Support ticket 

Include: 

Related resources 

• Activity Import Connectors documentation 
• Monitoring Event Activity documentation 
• How to Troubleshoot Logs Not Appearing in Securonix 

Have you used a connector-specific backfill, checkpoint, or collection-window approach that helped recover missing events? Share what worked in the Community—your experience may help another team close a data gap. 

If the connector completes successfully but continues to miss expected source events, or if the issue requires investigation of tenant-specific connector behavior, backend processing, or a supported backfill method, open a Securonix Support ticket so the team can investigate with you.