What should organisations keep at full fidelity in telemetry pipelines?

Why full-fidelity telemetry belongs at the point of accountability

Full-fidelity telemetry is most valuable where the record itself may become evidence, not just an operational signal. Error, fatal, privileged, and incident-response events often carry the context needed to reconstruct what happened, prove what was accessed, and distinguish normal failure from abuse. Once those records are sampled away, the investigation may still detect a problem, but it may lose the sequence that explains it.

That distinction matters because telemetry is not one control objective. Some streams exist to support fast aggregation and trend analysis, while others support attribution, auditability, or response. If a log line might be used to establish who did what, when, and from where, the organisation should treat lossless capture as part of the control design, not as an optional storage preference.

Where sampling is appropriate, and where it becomes a control failure

Sampling and filtering are useful for high-volume, repetitive telemetry that adds little investigative value at event level. Health checks, routine success paths, and other low-risk repeating patterns can often be summarized without weakening the security outcome. The key test is whether the control objective still holds if individual events are never recovered.

By contrast, aggressive filtering is dangerous on streams that carry exceptions, escalations, administrative activity, or response actions. Those records often mark the transition from routine operations to a security-relevant state. When the signal is sparse but important, reducing it for cost or noise reasons can create blind spots exactly where responders need precision.

Shai Hulud npm malware campaign shows why preserving high-value telemetry around exposed secrets and package activity matters when investigators need to reconstruct the path of compromise. reviewdog Action compromise 2025 is another example of how small gaps in CI/CD visibility can hide the credential chain that made the next abuse possible. ArtiPACKED 2024 reinforces that runtime tokens and artifact exposure are not theoretical when the logs and artifacts themselves become part of the evidence trail.

What good telemetry fidelity looks like in practice

Good practice is to define which event classes are evidence-bearing before anyone tunes the pipeline. That usually means preserving complete records for failures, privilege changes, incident-response activity, authentication anomalies, security tool actions, and any event that could support disciplinary, legal, or regulatory review. The organisation should also preserve enough surrounding context, such as timestamps, actor identifiers, request metadata, and correlation IDs, to make the record usable.

The strongest design pattern is selective fidelity, not blanket verbosity. High-value streams stay intact, while noisy operational streams can be compressed, aggregated, or sampled if the business can prove that no control objective depends on the missing detail. Retention, immutability, and access governance matter here too, because telemetry that is preserved but easy to alter or delete does not deliver the accountability the organisation thinks it has.

Risk and Threat Considerations

When organisations sample or filter the wrong telemetry, the main risk is not merely reduced observability, it is evidentiary loss. An attacker who anticipates that privileged actions, failed checks, or incident-response steps are being downsampled gets a much easier path to blending in, erasing sequence, or creating ambiguity after compromise.

Failure mechanism: The pipeline strips or truncates the exact events that show privilege use, escalation, containment, or exfiltration timing, so responders can no longer reconstruct the incident with confidence.

Impact: Investigation quality drops, accountability becomes harder to prove, and the organisation may be unable to demonstrate what happened to auditors, regulators, or affected stakeholders.

Practitioner Guidance

What to prioritise: Keep full-fidelity capture for any stream that may later serve as evidence, especially privileged operations, failures, and incident-response activity. Treat the question as one of control objective, not log volume.

What to verify: Confirm that every sampled stream has a documented reason why event-level detail is unnecessary, and that the same decision is not being reused for security-relevant exceptions by default. If the answer depends on “we can infer it later,” the pipeline is probably too lossy.

Practitioner takeaway: The right boundary is not between “important” and “unimportant” logs, it is between telemetry that can safely be summarized and telemetry whose missing details would weaken investigation or accountability.

Related resources from NHI Mgmt Group

• Should organisations keep full-fidelity agent logs in the same place as operational telemetry?
• How should security teams keep telemetry pipelines vendor-neutral?
• Why do organisations use pseudonymization instead of full anonymization in SaaS and AI pipelines?
• How do organisations keep long-term telemetry useful for investigations without locking themselves into one SIEM?